Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

An enterprise is designing a cross-account data ingestion pipeline. Applications running on Amazon EC2 instances in Account A (111111111111111111111111) must retrieve sensitive log files from an Amazon S3 bucket located in Account B (222222222222222222222222). The EC2 instances run inside an IAM instance profile associated with the IAM role `AppRole`. The S3 bucket in Account B is encrypted with a Customer Managed Key (CMK) in AWS KMS. The company's security policy requires that all cross-account access must utilize temporary credentials, enforce the principle of least privilege, and ensure all data remains encrypted.

Which configuration should the Solutions Architect implement to meet these requirements?

  1. A
    Create a new IAM user in Account B with permissions to read from the S3 bucket and decrypt using the KMS key. Generate long-term access keys for this IAM user, and configure the application on the EC2 instances in Account A to use these credentials.
  2. B
    Generate access keys for Account B's AWS account root user. Store these credentials in Systems Manager Parameter Store as a standard String parameter, and configure the applications on the EC2 instances in Account A to retrieve these credentials at runtime to perform S3 operations.
  3. Configure the S3 bucket policy in Account B to grant s3:GetObject permissions to the IAM role AppRole in Account A. Attach an IAM policy to AppRole in Account A that allows s3:GetObject on the Account B S3 bucket. Configure the KMS key policy in Account B to allow AppRole the kms:Decrypt action, and enable automatic annual key rotation on the KMS key.Answer
  4. D
    Configure the EC2 instances' AppRole in Account A to assume a role in Account B. Enable KMS automatic key rotation in Account B, and perform a manual re-encryption of all historical log files in S3 because rotating the Customer Managed Key disables the ability to decrypt historical logs encrypted under the previous key version.

Answer

Configure the S3 bucket policy in Account B to grant s3:GetObject permissions to the IAM role AppRole in Account A, attach an IAM policy to AppRole in Account A allowing s3:GetObject, configure the KMS key policy in Account B to allow AppRole the kms:Decrypt action, and enable automatic annual key rotation on the KMS key.
The correct configuration establishes cross-account access using resource-based policies (S3 bucket policy and KMS key policy) to trust the IAM role AppRole in Account A. This allows the application running on the EC2 instances to directly access the bucket using temporary security credentials managed by the EC2 instance profile, conforming to security best practices. Enabling automatic KMS key rotation satisfies the encryption requirement without disrupting access to older objects.

Step-by-Step Solution

1
Configure permissions for the S3 bucket in Account B.
The resource-based S3 bucket policy in Account B allows access to the IAM role in Account A.
For cross-account access, both the IAM policy in the trusting account (Account A) and the resource policy in the trusted account (Account B) must explicitly grant access.
2
Configure the IAM role permissions in Account A.
The identity-based policy attached to AppRole allows it to perform s3:GetObject on the bucket in Account B.
This completes the IAM delegation requirement from the client side.
3
Grant decryption permissions on the KMS key in Account B.
The KMS key policy is modified to allow AppRole in Account A to call kms:Decrypt.
Since the bucket is encrypted with a Customer Managed Key, the caller must have decrypt permissions on the key. KMS key policies must explicitly grant cross-account access, as identity-based policies alone cannot delegate cross-account access without key policy approval.
4
Enable automatic annual key rotation on the KMS key.
AWS KMS will automatically rotate the key annually without affecting current access.
KMS key rotation preserves older key versions so that existing data remains readable without manual re-encryption.

Key Concept

Cross-account resource access using resource-based policies (S3 and KMS) in combination with identity-based IAM policies, while adhering to temporary credential security policies and KMS rotation behaviors.
Estimated Time:2m 30s
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic