A financial transaction processor uses AWS Organizations to manage multiple member account… — AWS Certified Solutions Architect - Professional

A financial transaction processor uses AWS Organizations to manage multiple member accounts. Under PCI-DSS compliance requirements, all payment gateway application logs must be secured and centrally archived. The payment gateway runs on Amazon ECS using AWS Fargate within a Production account ( $444444444444$ ). These logs must be written directly to a centralized Amazon S3 bucket located in a Security Auditing account ( $999999999999$ ). The S3 bucket is configured with default encryption using a customer-managed AWS KMS key (KMS CMK) to enforce security team control over key rotation and policies. The architecture must enforce the principle of least privilege, preventing unauthorized internal access from other accounts within the AWS Organization.

Which two configurations are required to establish this secure log transport?

In the Security Auditing account ( $999999999999$ ), configure the key policy of the Customer Managed KMS key to allow the Production account's ECS task role IAM principal ( $arn:aws:iam::444444444444:role/PaymentGatewayTaskRole$ ) to perform `kms:GenerateDataKey` and `kms:Decrypt` actions. In the destination S3 bucket policy, allow the same ECS task role principal to perform `s3:PutObject` actions.Answer
In the Production account ( $444444444444$ ), attach an IAM policy to the ECS task role that grants `s3:PutObject` permissions on the destination S3 bucket in the Security Auditing account, and `kms:GenerateDataKey` and `kms:Decrypt` permissions on the KMS key ARN in the Security Auditing account.Answer
C
In the Security Auditing account ( $999999999999$ ), configure default S3 bucket encryption using the AWS-managed S3 key (`aws/s3`). In the Production account ( $444444444444$ ), attach an IAM policy to the ECS task role allowing `kms:GenerateDataKey` on the `aws/s3` key resource in the Security Auditing account.
D
In the AWS Organizations Management account, create and attach a Service Control Policy (SCP) to the Production account's Organizational Unit (OU) that grants `s3:PutObject` and `kms:GenerateDataKey` permissions to the ECS task role, thereby bypassing the need to create local IAM policies in the Production account.
E
In the Security Auditing account ( $999999999999$ ), configure the destination S3 bucket policy with a wildcard Principal (`"Principal": "*"`) and include a condition for `"StringEquals": {"aws:PrincipalOrgID": "o-exampleorgid"}` to allow any identity within the Organization to write logs, relying on the KMS key policy alone to restrict access to the ECS task role.

Answer

The correct configurations are: (1) configuring the Customer Managed Key policy and S3 bucket policy in the Security Auditing account to permit cross-account access to the Production ECS task role, and (2) attaching an IAM policy to the Production ECS task role allowing write operations to the S3 bucket and data key generation on the KMS key.

To achieve secure cross-account log delivery to an S3 bucket encrypted with a KMS key under strict least-privilege requirements, you must perform two main configurations: First, the resource policies in the destination Security Auditing account (both the S3 bucket policy and the KMS Customer Managed Key policy) must explicitly trust and permit access to the specific ECS task role principal in the Production account. Second, the identity policy (IAM policy) in the source Production account attached to the ECS task role must authorize outbound access to both the external S3 bucket and the KMS key. Customer Managed Keys are required since AWS-managed keys cannot be shared across accounts.

Step-by-Step Solution

Establish a Customer Managed Key (CMK) in the Security Auditing account (

999999999999

A key is provisioned whose key policy can be modified to grant cross-account permissions.

AWS-managed keys (like `aws/s3`) do not support cross-account sharing because their key policies cannot be modified.

Modify the KMS key policy in the Security Auditing account.

The Production account ECS task role is allowed to perform `kms:GenerateDataKey` and `kms:Decrypt` operations.

Resource-based policies (like the KMS key policy) must explicitly trust the external IAM principal for cross-account operations.

Modify the destination S3 bucket policy in the Security Auditing account.

The Production account ECS task role is allowed to perform `s3:PutObject` operations.

The bucket policy must explicitly permit the cross-account principal to upload objects to the destination bucket.

Attach a local IAM policy to the ECS task role in the Production account (

444444444444

The task role is authorized to interact with both the external S3 bucket and the external KMS key.

Cross-account access requires authorization from both the identity-based policy in the source account and the resource-based policies in the destination account.

Key Concept

Cross-account access to S3 buckets encrypted with Customer Managed KMS Keys

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic