Examkin

Question

Difficulty: Very hardData Encryption and Key Management

An enterprise has a security account (Account B) that hosts an AWS KMS Customer Managed Key (CMK). This CMK is used to encrypt sensitive telemetry data stored in Amazon S3 buckets located in a production account (Account A). The processing application in Account A runs on Amazon EC2 instances and requires access to decrypt these S3 objects. A security requirement states that the CMK must be rotated annually. The security team wants to ensure that key rotation does not disrupt the application's ability to read older archived S3 objects encrypted with previous versions of the key, and that the configuration strictly adheres to the principle of least privilege without exposing access credentials. Which of the following architectural configurations meets these requirements?

  1. A
    Enable automatic key rotation on the CMK in Account B. To ensure decryption capability is maintained for older objects, schedule a monthly AWS Lambda function to decrypt and re-encrypt all historical S3 data in Account A under the newly rotated key version before the previous key material is retired.
  2. B
    Enable automatic key rotation on the CMK in Account B. Store the CMK ARN and the security account's IAM cross-account access keys as a plain String parameter in AWS Systems Manager Parameter Store to allow the EC2 instances in Account A to programmatically authenticate and bypass cross-account IAM role mapping.
  3. Enable automatic key rotation on the CMK in Account B. In Account B, edit the CMK key policy to grant the EC2 IAM role in Account A permissions for the kms:Decrypt and kms:GenerateDataKey actions. In Account A, attach an IAM policy to the EC2 IAM role allowing these same KMS actions on the CMK ARN.Answer
  4. D
    Enable automatic key rotation on the CMK in Account B. To simplify cross-account permissions, configure the key policy in Account B to allow access to the AWS account root user of Account A, and use the root credentials of Account A within the processing application to perform all S3 decryption tasks.

Answer

Enable automatic key rotation on the CMK in the security account, configure the CMK's key policy to trust the production account's IAM role, and attach a matching IAM policy to the role in the production account allowing decryption and data key generation.
The correct configuration enables automatic key rotation, which naturally preserves all historical backing keys to decrypt older objects without requiring re-encryption. Cross-account access is correctly configured by editing the KMS key policy in Account B to trust the EC2 IAM role in Account A, and attaching an IAM policy to that role in Account A to permit the necessary KMS actions.

Step-by-Step Solution

1
Evaluate key rotation behavior
Automatic key rotation preserves the historical backing keys automatically. Older S3 objects can still be decrypted without any manual re-encryption workflow.
Understanding KMS automatic rotation mechanics prevents unnecessary data re-encryption operations.
2
Establish trust on the KMS key
Edit the KMS key policy in Account B to allow the specific IAM role in Account A to perform kms:Decrypt and kms:GenerateDataKey.
For cross-account access, the key policy itself must explicitly authorize the external identity or account.
3
Authorize the IAM identity in the production account
Attach an IAM policy to the EC2 execution role in Account A allowing kms:Decrypt and kms:GenerateDataKey on the Account B CMK ARN.
Cross-account access requires explicit permission in both the resource policy (key policy) and the identity policy (IAM policy).
4
Enforce credentials best practices
Verify that no root credentials or plain text parameters are used to store access keys.
This guarantees compliance with AWS security best practices and the principle of least privilege.

Key Concept

Cross-account AWS KMS key access and automatic key rotation behavior
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic