Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A company is onboarding a third-party audit firm to perform security compliance checks on their AWS infrastructure. The auditor needs access to read configuration logs from an Amazon S3 bucket located in the company's production AWS account. The S3 bucket is encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The auditor also needs to retrieve database credentials from AWS Secrets Manager to verify rotation compliance. Which configuration meets these requirements securely under the principle of least privilege?

  1. A
    Create individual IAM users in the production AWS account for each external auditor. Generate long-term IAM access keys for each user, and attach a policy directly to these users granting read permissions to S3, KMS, and Secrets Manager.
  2. Configure a cross-account IAM role in the production account that the auditor's AWS account can assume. Attach an IAM policy to the role that grants read access to the S3 bucket, decryption permissions on the KMS key, and read access to the Secrets Manager secret. Update the KMS key policy in the production account to allow the cross-account role to perform the kms:Decrypt action.Answer
  3. C
    Enable access keys on the production account's root user, and share these credentials securely with the auditing firm. Instruct the auditor to use these root credentials to run their assessment scripts, ensuring complete visibility across all resources and bypassing any policy permission issues.
  4. D
    Configure a cross-account IAM role in the production account. To simplify the auditor's script configuration, store the database credentials in Systems Manager Parameter Store as a plaintext String parameter, and grant the cross-account role permission to read this parameter instead of using Secrets Manager.

Answer

Configure a cross-account IAM role in the production account that the auditor's AWS account can assume, attach an IAM policy to the role granting access to the S3 bucket, the KMS key, and the Secrets Manager secret, and update the KMS key policy to permit the role to perform the kms:Decrypt action.
The correct configuration implements cross-account access using an IAM role, which is the AWS-recommended security best practice for granting external third-party access. It avoids creating long-term credentials. Since the S3 bucket is encrypted using a Customer Managed Key (CMK), cross-account access requires permissions to be granted in both the role's identity-based policy and the key policy of the KMS key. Granting the role access to the S3 bucket, the KMS key, and the Secrets Manager secret follows the principle of least privilege.

Step-by-Step Solution

1
Create a cross-account IAM role in the production AWS account.
An IAM role is created with a trust policy that permits the auditor's AWS account to assume it.
This establishes secure cross-account delegation and avoids the creation of long-term credentials for external entities.
2
Attach an identity-based policy to the IAM role.
The role is granted permissions to read from the S3 bucket, decrypt using the KMS key, and retrieve the secret from Secrets Manager.
This defines the specific actions the role is authorized to perform under the principle of least privilege.
3
Modify the KMS Customer Managed Key policy in the production account.
The key policy is updated to explicitly allow the cross-account role to perform the kms:Decrypt action.
For cross-account access to resources encrypted with KMS, both the identity-based policy in the calling account/role and the resource-based key policy in the owning account must explicitly allow the action.

Key Concept

Cross-account access delegation using IAM roles, S3 bucket policies, Secrets Manager, and KMS key policies.
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic