Examkin

Question

Difficulty: MediumData Encryption and Key Management

An application running on Amazon EC2 instances in AWS Account A needs to read encrypted payload logs from an Amazon S3 bucket located in AWS Account B. The security team requires that the S3 bucket use Server-Side Encryption with AWS KMS customer managed keys (SSE-KMS) and that the key undergoes annual rotation. Additionally, the configuration must allow the EC2 application role in Account A to decrypt the files while preventing the historical log files from needing manual re-encryption. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Configure the KMS key policy in Account B to allow the IAM role of the EC2 instances in Account A to perform the kms:Decrypt action, and grant kms:Decrypt permissions to the IAM role in Account A.Answer
  2. Enable automatic key rotation for the customer managed key in Account B, which automatically rotates the backing key material annually while retaining previous versions to decrypt existing logs.Answer
  3. C
    Manually rotate the KMS key in Account B annually by creating a new key, and execute an S3 Batch Operations job to re-encrypt all historical logs with the new key version.
  4. D
    Configure the EC2 application in Account A to authenticate using IAM user access keys that are stored as a plaintext String parameter in AWS Systems Manager Parameter Store.
  5. E
    Use Account B's root user credentials on the EC2 instances in Account A to perform all log decryption tasks, bypassing cross-account KMS key policy configurations.

Answer

Configure the KMS key policy in Account B to allow the IAM role of the EC2 instances in Account A to perform the kms:Decrypt action, grant kms:Decrypt permissions to the IAM role in Account A, and enable automatic key rotation for the customer managed key in Account B.
To grant an EC2 instance in Account A access to a KMS key in Account B, both the key policy in Account B must permit the IAM role in Account A, and the IAM role in Account A must have permissions to decrypt. In addition, enabling automatic key rotation handles key rotation seamlessly because AWS KMS keeps older versions of backing keys available for decrypting historical data, preventing the need for manual re-encryption.

Step-by-Step Solution

1
Configure cross-account KMS permissions.
The key policy in Account B is updated to delegate permission to the IAM role in Account A, and the IAM role in Account A is granted permission to use the key.
For cross-account access, permissions must be granted in both the resource's key policy and the consumer's IAM policy.
2
Enable automatic key rotation on the customer managed key in Account B.
The key automatically rotates its backing material annually without affecting historical data.
AWS KMS automatic key rotation keeps previous versions of the backing key active for decryption, meaning existing logs do not need to be manually re-encrypted.

Key Concept

Cross-account KMS key policies and automatic key rotation mechanics
Estimated Time:2m 0s
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic