Examkin

Question

Difficulty: Very hardIdentity and Access Management (IAM)

An enterprise uses a multi-account AWS architecture. Internal auditors authenticate via an identity provider (IdP) federated with a central Identity AWS account. The auditors need to read sensitive audit logs stored in an Amazon S3 bucket located in a separate Production AWS account. The S3 bucket is encrypted using a customer managed AWS KMS key in the Production account. A solutions architect must design a secure access strategy that adheres to the principle of least privilege.

Which strategy should the solutions architect implement to meet these requirements?

  1. Configure SAML 2.0 federation to allow auditors to assume an IAM role in the Identity account, which then assumes a cross-account IAM role in the Production account. Attach an IAM policy to the Production role allowing s3:GetObject on the bucket and kms:Decrypt on the KMS key. Configure the S3 bucket policy and the KMS key policy in the Production account to explicitly trust the Production IAM role.Answer
  2. B
    Create individual IAM users for each auditor in the Production account. Share long-term access keys for these users, and assign them to an IAM group with policies allowing s3:GetObject on the S3 bucket and kms:Decrypt on the KMS key. Configure the S3 bucket policy and the KMS key policy to trust the IAM group.
  3. C
    Configure the federated IdP to allow access using the Production account's root user credentials for audit operations. Modify the KMS key policy to permit all decrypt operations to the root user, and configure the S3 bucket policy to allow public read access restricted only by the root user's session.
  4. D
    Configure the auditors' application to authenticate using an IAM role. Store the S3 bucket credentials and KMS decryption keys as plaintext String parameters in AWS Systems Manager Parameter Store in the Production account, allowing the application to retrieve them at runtime to decrypt the audit logs.

Answer

Configure SAML 2.0 federation to allow auditors to assume an IAM role in the Identity account, which then assumes a cross-account IAM role in the Production account. Attach an IAM policy to the Production role allowing s3:GetObject on the bucket and kms:Decrypt on the KMS key. Configure the S3 bucket policy and the KMS key policy in the Production account to explicitly trust the Production IAM role.
The correct strategy establishes identity federation to avoid creating long-term IAM users, uses cross-account role assumption to bridge the Identity and Production accounts, and configures the necessary trust/permission policies across IAM, S3, and KMS. In cross-account scenarios, S3 bucket policies and KMS key policies must explicitly grant access to the external role, and the role's policy itself must permit the corresponding API calls.

Step-by-Step Solution

1
Establish federated identity access using SAML 2.0 with an Identity provider.
Users authenticate against the corporate directory and assume an IAM role in the central Identity account without requiring long-term IAM user credentials.
This centralizes identity management and follows AWS best practices for enterprise user access.
2
Configure cross-account IAM role assumption from the Identity account to the Production account.
The IAM role in the Identity account is trusted to assume a target role in the Production account.
This enables secure boundaries across different AWS accounts in a multi-account landing zone.
3
Assign least-privilege permissions to the target IAM role in the Production account and configure resource-based policies.
The target IAM role is granted permission to get objects and decrypt them via KMS. The S3 bucket policy and KMS key policy explicitly trust the target IAM role.
For cross-account resource access (specifically S3 and KMS), both the caller's IAM policy and the resource-based policy must explicitly allow the action.

Key Concept

Cross-Account IAM delegation and Resource Access with KMS Decryption under Federated Identities
Estimated Time:3m 0s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic