Examkin

Question

Difficulty: HardData Encryption and Key Management

A company is designing a secure multi-account architecture on AWS. Applications running on Amazon EC2 instances in Account A must write encrypted logs to an Amazon S3 bucket located in Account B. The logs must be encrypted at rest using an AWS KMS customer managed key owned by Account B. The security team needs to configure the required permissions to allow the applications to perform cryptographic operations and upload the logs securely. Which combination of configuration steps will meet these requirements? (Select TWO.)

  1. In the destination account (Account B), configure the KMS key policy to grant the source account (Account A) permission to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions.Answer
  2. In the source account (Account A), attach an IAM policy to the EC2 instances' IAM role that grants permissions to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions on the KMS key ARN in Account B.Answer
  3. C
    In the destination account (Account B), grant administrative control of the KMS key directly to the AWS account root user of the source account (Account A) to manage cryptographic permissions, violating least privilege.
  4. D
    In the destination account (Account B), enable automatic key rotation for the KMS customer managed key, expecting AWS to immediately decrypt and re-encrypt all existing historical S3 objects using the new key version.
  5. E
    In the source account (Account A), configure the application to store the database credentials and KMS keys as plaintext String parameters in Systems Manager Parameter Store for direct retrieval by the application instances.

Answer

In Account B, configure the KMS key policy to grant the source account permissions for the cryptographic actions, and in Account A, attach an IAM policy to the application role granting permissions on the target KMS key ARN.
For cross-account access to AWS KMS customer managed keys, permissions must be explicitly declared on both sides. First, the key policy in the destination account must permit the source account's root user or the specific IAM principal to access the key. Second, the source account's IAM role must have an identity-based policy that explicitly grants permission to use the external key ARN for the necessary operations.

Step-by-Step Solution

1
Analyze cross-account KMS authorization flow.
Identify that cross-account access to a customer managed key requires permissions to be granted in both the resource-based policy (KMS key policy) and the identity-based policy (IAM policy).
AWS evaluates both policies for cross-account KMS requests, and both must explicitly allow the action.
2
Configure destination account resources.
Modify the KMS key policy in Account B to include Account A in the Principal block and allow the necessary cryptographic operations.
This establishes trust and delegates authorization decisions to Account A.
3
Configure source account identities.
Attach an IAM policy to the EC2 instance role in Account A specifying the target KMS key ARN and the cryptographic actions.
This authorizes the EC2 instances to request data keys from the external KMS key.

Key Concept

Cross-account AWS KMS authorization requires matching policies in both the resource owner account and the caller identity account.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic