Examkin

Question

Difficulty: MediumData Encryption and Key Management

A healthcare provider hosts a web application on Amazon EC2 instances in AWS Account A. The application processes sensitive patient files and stores them in an Amazon S3 bucket located in Account A. To comply with regulatory standards, all files must be encrypted at rest using an AWS KMS customer managed key stored in a centralized security account (Account B).

Which combination of configuration steps is required to enable the EC2 instances in Account A to upload encrypted files to the S3 bucket? (Select TWO.)

  1. In Account B, configure the KMS key policy to grant the IAM role associated with the EC2 instances in Account A permissions to perform the kms:GenerateDataKey and kms:Decrypt operations.Answer
  2. In Account A, attach an IAM policy to the EC2 instances' IAM role that grants permissions to perform the kms:GenerateDataKey and kms:Decrypt operations on the key ARN in Account B.Answer
  3. C
    In Account B, configure the KMS key policy to grant administrative access to the root account of Account A, and configure the application to use root credentials for daily encryption tasks.
  4. D
    Store the plaintext KMS key material in the Systems Manager Parameter Store as a String parameter type to allow the EC2 instances to retrieve the key for local encryption.
  5. E
    Enable automatic key rotation on the customer managed key in Account B, which automatically re-encrypts all previously stored objects in Account A when rotation occurs.

Answer

In Account B, configure the KMS key policy to grant the IAM role associated with the EC2 instances in Account A permissions to perform the kms:GenerateDataKey and kms:Decrypt operations, and in Account A, attach an IAM policy to the EC2 instances' IAM role that grants permissions to perform the kms:GenerateDataKey and kms:Decrypt operations on the key ARN in Account B.
To successfully establish cross-account access to an AWS KMS customer managed key, permissions must be granted on both sides of the trust boundary. First, the key policy in Account B (the key owner) must explicitly allow the IAM role of the EC2 instances in Account A to use the key for cryptographic operations. Second, the IAM policy attached to the EC2 instances' IAM role in Account A must grant permission to perform the target actions (specifically generating data keys and decrypting) referencing the full ARN of the KMS key in Account B.

Step-by-Step Solution

1
Determine the cross-account encryption requirements.
Identify that the EC2 instances in Account A need to access a customer managed key located in Account B to perform envelope encryption (generate a data key) when writing to Amazon S3.
Since the KMS key and the S3 bucket are in different accounts, cross-account permissions must be explicitly set on both the key policy and IAM policy.
2
Configure the key policy in the key's host account (Account B).
Modify the key policy to explicitly authorize the IAM role from Account A to perform kms:GenerateDataKey and kms:Decrypt.
By default, customer managed keys are only accessible within the account where they reside unless the key policy explicitly allows cross-account entities.
3
Configure the IAM policy in the identity's host account (Account A).
Attach an IAM policy to the EC2 instance role in Account A that permits kms:GenerateDataKey and kms:Decrypt targeting the specific ARN of the KMS key in Account B.
For cross-account access, both the trust boundary at the resource (key policy) and the permission boundary at the caller (IAM policy) must allow the interaction.

Key Concept

Cross-account KMS key access requires trust configuration on both the key policy (resource-based policy) in the owner account and the IAM policy (identity-based policy) in the consumer account.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic