Examkin

Question

Difficulty: MediumData Encryption and Key Management

A company has a central logging Amazon S3 bucket in AWS Account A. Applications running on Amazon EC2 instances within an Auto Scaling group in AWS Account B must write application logs directly to this S3 bucket. The logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS) located in Account A. The security team requires that the encryption key is rotated automatically every year and that access to the key follows the principle of least privilege. Which combination of actions must the solutions architect take to configure this secure cross-account encryption setup? (Select TWO.)

  1. Configure the key policy of the Customer Managed Key in Account A to grant the IAM role in Account B permissions to perform the kms:GenerateDataKey and kms:Decrypt actions.Answer
  2. Configure the IAM policy of the application role in Account B to grant s3:PutObject permissions on the S3 bucket in Account A and kms:GenerateDataKey permissions on the KMS key in Account A.Answer
  3. C
    Enable automatic annual key rotation on the Customer Managed Key in Account A, which will automatically re-encrypt all historically stored log objects in the S3 bucket using the new key material.
  4. D
    Store the credentials of an IAM user from Account A inside Systems Manager Parameter Store as a plain String parameter in Account B to authenticate the logging requests.
  5. E
    Configure the applications in Account B to authenticate using the AWS account root user credentials of Account A to bypass KMS cross-account key policy restrictions.

Answer

Configure the key policy of the Customer Managed Key in Account A to trust the IAM role in Account B, and configure the IAM policy of the application role in Account B to grant put object permissions on the S3 bucket and generate data key permissions on the KMS key.
For secure cross-account logging to an S3 bucket encrypted with SSE-KMS, the application's IAM role in Account B must be granted permissions to generate the data key from Account A's KMS key and write to the S3 bucket. Additionally, the Customer Managed Key policy in Account A must explicitly allow the IAM role in Account B to use the key.

Step-by-Step Solution

1
Configure the destination resource policies in Account A.
The KMS key policy is updated to allow Account B's role to perform kms:GenerateDataKey and kms:Decrypt, and the S3 bucket policy is updated to allow Account B's role to perform s3:PutObject.
Resource-based policies must authorize cross-account entities to access resources directly.
2
Configure the client-side IAM policy in Account B.
The IAM policy attached to the EC2 instance role in Account B is updated to permit s3:PutObject on the Account A bucket and kms:GenerateDataKey on the Account A KMS key.
An IAM entity performing cross-account actions must have local identity-based permissions allowing access to target external resources.

Key Concept

Cross-account access with SSE-KMS requires explicit authorization in both the source IAM policy and the destination resource policies (S3 bucket policy and KMS key policy).
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic