Examkin

Question

Difficulty: HardData Encryption and Key Management

An application running on Amazon EC2 instances in Account A (111122223333111122223333) must write daily transaction records to an Amazon S3 bucket located in Account B (444455556666444455556666). The security policy mandates that all data in the S3 bucket must be encrypted at rest using a Customer Managed Key (CMK) stored in Account B's AWS Key Management Service (AWS KMS). The company requires that cross-account access is configured using the principle of least privilege. Which combination of actions must the solutions architect take to meet these requirements? (Select TWO.)

  1. Configure the key policy of the Customer Managed Key in Account B to grant the EC2 IAM role in Account A permissions for the kms:GenerateDataKey and kms:Decrypt actions.Answer
  2. Attach an IAM policy to the EC2 role in Account A that allows the s3:PutObject action on the S3 bucket in Account B and the kms:GenerateDataKey action on the KMS key in Account B.Answer
  3. C
    Enable automatic key rotation on the KMS key in Account B, which will automatically re-encrypt all previously uploaded historical transaction records in the S3 bucket with the new key version.
  4. D
    Store the database credentials and the KMS key ARN as a plaintext String parameter in AWS Systems Manager Parameter Store in Account A to allow the application to retrieve them programmatically.
  5. E
    Configure the S3 bucket policy in Account B to allow the root account of Account A full access, and use the default AWS managed key aws/s3 in Account B for the cross-account encryption.

Answer

To configure secure cross-account S3 uploads with KMS encryption, the solutions architect must configure the Customer Managed Key's policy in Account B to grant access to the EC2 IAM role in Account A, and attach an IAM policy to the EC2 IAM role in Account A that permits writing to the bucket and generating data keys using the cross-account KMS key.
The correct combination of actions consists of configuring the key policy in Account B to grant key usage permissions to the external IAM role in Account A, and attaching an IAM policy to the EC2 IAM role in Account A to authorize access to both the target S3 bucket and the KMS key. Because AWS managed keys cannot be edited, a Customer Managed Key (CMK) must be used. Additionally, for cross-account resource access, both the resource-based policy (the KMS key policy in Account B) and the identity-based policy (the IAM policy in Account A) must explicitly permit the operations.

Step-by-Step Solution

1
Analyze the requirements for cross-account KMS and S3 permissions.
Identify that for Account A's IAM role to write to Account B's KMS-encrypted S3 bucket, permissions must be granted on both the KMS key policy (in Account B) and the IAM policy (in Account A).
In AWS, cross-account access requires explicit permission from both the resource owner (via resource-based policies) and the trust delegation from the principal's account (via identity-based policies).
2
Determine the specific KMS permissions required for writing encrypted data to S3.
The IAM role needs kms:GenerateDataKey to generate the encryption key for new objects and kms:Decrypt for multipart uploads or reading.
Amazon S3 uses envelope encryption via KMS where the uploader needs permissions to generate the data key from the master key.
3
Configure the identity-based policy in Account A.
Attach an IAM policy to the EC2 role allowing s3:PutObject on the S3 bucket in Account B and kms:GenerateDataKey on the KMS key in Account B.
The EC2 role needs local IAM permission to target the external resources in Account B.

Key Concept

Cross-account access to KMS-encrypted S3 buckets requires resource policies on the destination side (S3 bucket policy and KMS key policy) to trust the source principal, and an identity-based IAM policy on the source side to authorize the actions.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic