Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

A company has two AWS accounts: Account A for application workloads and Account B for centralized data storage. An application running on Amazon ECS tasks in Account A needs to write logs and data to an Amazon S3 bucket in Account B. The S3 bucket is encrypted using an AWS Key Management Service (AWS KMS) customer managed key also located in Account B. The company's security policy requires that all access must follow the principle of least privilege, and no long-term credentials can be stored. Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. Attach an IAM policy to the ECS task role in Account A that allows the s3:PutObject action on the S3 bucket in Account B and the kms:GenerateDataKey action on the KMS key in Account B.Answer
  2. In Account B, configure the S3 bucket policy to allow the ECS task role from Account A to perform the s3:PutObject action, and update the KMS key policy to allow the same role to perform the kms:GenerateDataKey action.Answer
  3. C
    Create an IAM user in Account B with programmatic access, attach a policy granting s3:PutObject and kms:GenerateDataKey permissions, and store the credentials in Systems Manager Parameter Store in Account A as a String parameter.
  4. D
    Attach an IAM policy to the ECS task execution role in Account A that allows the sts:AssumeRole action, and update the KMS key policy in Account B to trust the AWS account root user of Account A.
  5. E
    Enable automatic key rotation for the default AWS managed key aws/s3 in Account B, and configure the S3 bucket policy to grant write permissions to the ECS container agent.

Answer

Attach an IAM policy to the ECS task role in Account A that allows the required S3 and KMS actions, and in Account B, update the S3 bucket policy and KMS key policy to explicitly trust the ECS task role ARN from Account A.
To establish secure cross-account access without long-term credentials, the ECS task role in Account A must be granted permissions via an IAM policy to write to the S3 bucket and generate data keys. Simultaneously, the resource policies (the S3 bucket policy and the KMS customer managed key policy) in Account B must be configured to trust the specific ECS task role ARN and permit the same actions. This bi-directional permission setup allows direct cross-account access using temporary security credentials.

Step-by-Step Solution

1
Identify the proper IAM role for ECS containerized application runtime permissions.
Select the ECS task role as the identity to attach access permissions to.
The ECS task role is utilized by the application running inside the container, whereas the task execution role is used only by the ECS container agent for infrastructure tasks.
2
Configure the client-side IAM policy in Account A.
Attach a policy to the ECS task role in Account A permitting `s3:PutObject` on the S3 bucket in Account B and `kms:GenerateDataKey` on the Customer Managed Key (CMK) in Account B.
The initiating IAM identity must have explicit permission to access the target cross-account resources.
3
Configure the resource-based policies in Account B.
Modify the S3 bucket policy and the KMS key policy in Account B to allow the ECS task role ARN from Account A to write data and generate data keys.
Cross-account access requires authorization from both the identity policy in the source account and the resource policies in the destination account. AWS Managed Keys cannot be modified for cross-account access, necessitating a Customer Managed Key.

Key Concept

Cross-account access to S3 and KMS requires configuration of both the IAM identity policies in the source account and resource policies (bucket and key policies) in the destination account, using temporary role credentials instead of long-term credentials.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic