Examkin

Question

Difficulty: Very hardData Encryption and Key Management

An architect is designing a secure log aggregation solution. A containerized application running on Amazon ECS in Account A must write encrypted JSON log files to an Amazon S3 bucket located in Account B. The logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS) owned by Account B.

The security constraints are:
1. The ECS task role in Account A must be able to encrypt new logs during upload but must be strictly prohibited from decrypting any logs already stored in the S3 bucket.
2. The KMS key must be rotated annually without requiring manual re-encryption of existing logs, and older logs must remain decryptable by authorized security analysts in Account B.

Which configuration meets these requirements with the least privilege?

  1. Configure the KMS key policy in Account B to allow the ECS task role in Account A to perform kms:GenerateDataKey and kms:DescribeKey operations. Enable automatic key rotation on the CMK in Account B.Answer
  2. B
    Configure the KMS key policy in Account B to allow the ECS task role in Account A to perform kms:GenerateDataKey and kms:Decrypt operations. Enable automatic key rotation on the CMK, and configure an AWS Lambda function to automatically decrypt and re-encrypt all historical S3 objects using the new key version upon rotation.
  3. C
    Configure the ECS task to retrieve a plaintext encryption password stored as a String parameter in AWS Systems Manager Parameter Store in Account B, perform client-side encryption of the logs, and manually update the Parameter Store value with a new password annually.
  4. D
    Configure the KMS key policy in Account B to allow the ECS task role in Account A to perform kms:Encrypt and kms:Decrypt operations. Create a new KMS CMK manually in Account B every year, update the S3 bucket default encryption settings to use the new CMK, and delete the previous CMK after 90 days.

Answer

Configure the KMS key policy in Account B to allow the ECS task role in Account A to perform kms:GenerateDataKey and kms:DescribeKey operations, and enable automatic key rotation on the CMK in Account B.
The correct configuration grants the ECS task role in Account A access only to generate the data key (kms:GenerateDataKey) and describe the key (kms:DescribeKey), which allows S3 to encrypt the logs during the upload process. Since kms:Decrypt is not granted, the ECS task cannot read or decrypt the logs. Enabling automatic key rotation on the Customer Managed Key (CMK) rotates the underlying key material annually. AWS KMS automatically preserves previous key versions to decrypt historical data when requested by authorized users, requiring no manual re-encryption or administrative intervention.

Step-by-Step Solution

1
Analyze cross-account write-only encryption requirements.
To upload an object encrypted with SSE-KMS, the S3 service handles the encryption on behalf of the client. The client needs the permission to generate a data key (kms:GenerateDataKey) but does not need the permission to decrypt (kms:Decrypt).
By omitting the kms:Decrypt permission from the ECS task role, we satisfy the constraint that the application must be strictly prohibited from decrypting existing logs.
2
Evaluate KMS automatic key rotation mechanics.
Enabling automatic key rotation on a Customer Managed Key rotates the backing key material annually while keeping the same key ID, metadata, and key policy.
AWS KMS automatically retains all historical backing key versions. When S3 or an authorized user requests decryption of older logs, KMS uses the matching historical key version to decrypt them. No manual re-encryption of existing logs is required, ensuring operational efficiency and data accessibility.
3
Evaluate alternative secret storage and rotation methods.
Using Parameter Store with plaintext parameters is insecure. Creating new keys manually and deleting old ones breaks decryption for historical data.
This confirms that using the native KMS automatic key rotation and the correct IAM permissions is the most secure and compliant design.

Key Concept

Write-only KMS permissions for S3 uploads and KMS automatic key rotation behavior.
Estimated Time:3m 0s
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic