Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A logistics company runs a fleet tracking application on Amazon EC2 instances in AWS Account A. The application must write daily transaction logs to an Amazon S3 bucket located in AWS Account B. The S3 bucket is configured with default encryption using an AWS KMS customer managed key (CMK) owned by Account B. The solutions architect must implement a secure, cross-account access solution that adheres to the principle of least privilege and avoids long-term security credentials. Which combination of steps will meet these requirements?

  1. A
    Enable the AWS account root user of Account B to generate access keys. Store these root access keys as a plaintext String parameter in the AWS Systems Manager Parameter Store of Account A. Configure the application on the EC2 instances to retrieve these root credentials at startup to authenticate the cross-account write and KMS encryption operations.
  2. B
    Create an IAM user in Account B with permissions to write to the S3 bucket and use the CMK. Generate long-term access keys for this user, and store them as a plaintext String parameter in the Systems Manager Parameter Store of Account A. Configure the EC2 instances to retrieve these access keys at runtime to perform the upload.
  3. Attach an IAM role to the EC2 instances in Account A. Grant the role permissions to perform s3:PutObject on the S3 bucket in Account B and kms:GenerateDataKey on the KMS CMK in Account B. In Account B, configure the S3 bucket policy to allow the IAM role to perform s3:PutObject, and configure the CMK key policy to allow the IAM role to perform kms:GenerateDataKey.Answer
  4. D
    Attach an IAM role to the EC2 instances in Account A. In Account B, configure the bucket policy and the CMK key policy to trust the entire AWS Account A. Enable automatic annual key rotation for the CMK in Account B, which will automatically decrypt and re-encrypt all existing log files in the S3 bucket using the new key version so that older key versions do not need to be preserved.

Answer

Attach an IAM role to the EC2 instances in Account A. Grant the role permissions to perform s3:PutObject on the S3 bucket in Account B and kms:GenerateDataKey on the KMS CMK in Account B. In Account B, configure the S3 bucket policy to allow the IAM role to perform s3:PutObject, and configure the CMK key policy to allow the IAM role to perform kms:GenerateDataKey.
The correct solution involves attaching an IAM role to the EC2 instances in Account A to provide temporary security credentials. The role is granted permission to write to Account B's bucket and generate data keys from Account B's customer managed key (CMK). In Account B, both the S3 bucket policy and the KMS key policy must trust the specific IAM role from Account A to allow the cross-account upload and encryption operations.

Step-by-Step Solution

1
Create and attach an IAM role to the Amazon EC2 instances in Account A to generate temporary security credentials.
The EC2 instances obtain temporary AWS credentials with the identity of the assumed role.
This avoids using long-term credentials (like IAM user access keys) and conforms to security best practices.
2
Assign IAM permissions to the role in Account A to write to the S3 bucket and to use the KMS key in Account B.
The local IAM role has the necessary permissions to initiate the upload and request key generation.
For cross-account access, the requesting account must grant the permission locally, in addition to the resource-level permissions in the destination account.
3
Update the S3 bucket policy in Account B to allow the IAM role in Account A to execute s3:PutObject.
Account B explicitly trusts the Account A IAM role to write objects to the S3 bucket.
Cross-account access to S3 requires the bucket owner to trust the external IAM principal via a bucket policy.
4
Configure the KMS key policy on the CMK in Account B to allow the IAM role in Account A to call kms:GenerateDataKey.
Account B allows the Account A IAM role to request a data key from KMS to encrypt the log files.
Since the bucket uses default KMS CMK encryption, the external role must have permissions on the KMS key policy to perform key operations.

Key Concept

Cross-account access to S3 buckets encrypted with a KMS Customer Managed Key requires IAM policies, S3 bucket policies, and KMS key policies to align and explicitly trust the calling IAM principal using temporary credentials.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic