Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A research organization is launching a new data analytics application. The application components are deployed on Amazon EC2 instances in a production AWS account (Account A). The application must upload raw datasets to an Amazon S3 bucket located in a centralized data lake AWS account (Account B). Compliance standards require that all data uploaded to the S3 bucket must be encrypted at rest. The security team must manage the encryption key policies and rotation schedules, and the audit team in Account B must be able to read and decrypt the data. How should the solutions architect design the security and encryption controls to meet these requirements?

  1. A
    Configure the S3 bucket in Account B to use the default AWS-managed KMS key for Amazon S3 (aws/s3) for server-side encryption. Update the S3 bucket policy in Account B to allow the application's IAM role in Account A to upload objects, and configure the application's IAM policy in Account A to permit access to the bucket.
  2. Create a customer managed key (CMK) in Account B. Configure the CMK key policy in Account B to grant Account A's application IAM role permissions to perform the kms:GenerateDataKey and kms:Decrypt actions. Attach an IAM policy to the application role in Account A that allows these same KMS actions on the CMK in Account B.Answer
  3. C
    Create a customer managed key (CMK) in Account B. Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account A and Account B that allows the application's IAM role to perform the required KMS actions on the CMK, without modifying the key policy in Account B or the IAM policy in Account A.
  4. D
    Create a customer managed key (CMK) in Account B. Configure the default KMS key policy to delegate permissions to Account B's root account. Grant the application's IAM role in Account A access to the S3 bucket via the bucket policy, and assume that Account B's root authorization will automatically delegate key usage to the cross-account role.

Answer

Create a customer managed key (CMK) in Account B. Configure the CMK key policy in Account B to grant Account A's application IAM role permissions to perform the kms:GenerateDataKey and kms:Decrypt actions. Attach an IAM policy to the application role in Account A that allows these same KMS actions on the CMK in Account B.
The correct answer provides a solution that fulfills all security and cross-account requirements. Since AWS-managed keys (like aws/s3) do not support policy modification and cannot be shared across accounts, a customer managed key (CMK) must be used. Furthermore, cross-account access to a KMS key requires explicit permission in both the KMS key policy (acting as a resource policy in the destination account) and the IAM policy of the IAM role (identity policy in the source account).

Step-by-Step Solution

1
Determine the type of KMS key required for cross-account S3 access.
Identify that a Customer Managed Key (CMK) is required because AWS-managed keys (e.g., aws/s3) cannot be shared across accounts.
AWS-managed KMS keys do not support policy modification, which is necessary to trust an external AWS account.
2
Configure permissions on the resource policy (KMS key policy).
Configure the key policy of the CMK in Account B to grant the specific IAM role in Account A permissions to perform kms:GenerateDataKey and kms:Decrypt.
For cross-account access, the resource owner must explicitly allow the external principal to use the resource.
3
Configure permissions on the identity policy (IAM policy).
Attach an IAM policy to the application's role in Account A allowing the same KMS actions on the CMK in Account B.
Cross-account access requires authorization from both the resource owner (resource policy) and the consumer's account administrator (identity policy).

Key Concept

Cross-Account KMS Key Delegation and Policy Evaluation
Estimated Time:2m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic