Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

A global healthcare provider is designing a patient medical records portal. The portal application runs on Amazon ECS tasks inside an Application Account (Account 444444444444). The ECS tasks must upload scanned medical records directly to a centralized Amazon S3 bucket located in a dedicated Compliance Account (Account 888888888888). The solutions architect must design a security and compliance control structure that meets the following requirements:
1. All objects uploaded to the S3 bucket must be encrypted at rest.
2. The ECS tasks must be able to write records to the S3 bucket, but must not be able to read or delete any existing objects.
3. The Compliance Account must automatically own all uploaded records to prevent cross-account access delegation complexities.
4. Security auditors in the Compliance Account must be able to read and decrypt the records.

Which combination of configuration steps will meet these requirements in the most secure manner?

  1. In the Compliance Account, configure the S3 bucket's Object Ownership setting to Bucket Owner Enforced. Create a customer managed KMS key in the Compliance Account, and configure its key policy to allow the ECS task role in the Application Account permissions to perform kms:GenerateDataKey and kms:Decrypt, and allow auditors in the Compliance Account to perform kms:Decrypt. In the Compliance Account, update the S3 bucket policy to allow the ECS task role in the Application Account to perform s3:PutObject. In the Application Account, grant the ECS task role IAM permissions to perform s3:PutObject on the S3 bucket and kms:GenerateDataKey and kms:Decrypt on the KMS key.Answer
  2. B
    In the Compliance Account, configure the S3 bucket's Object Ownership setting to Bucket Owner Enforced. Enable default S3 bucket encryption using the AWS managed key (aws/s3). Configure the S3 bucket policy to allow the ECS task role in the Application Account to perform s3:PutObject. In the Application Account, grant the ECS task role IAM permissions to perform s3:PutObject on the S3 bucket.
  3. C
    In the Compliance Account, configure the S3 bucket's Object Ownership setting to Bucket Owner Enforced. Create a customer managed KMS key in the Compliance Account. Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing both accounts that allows the ECS task role to perform s3:PutObject on the S3 bucket and kms:GenerateDataKey on the customer managed key, without configuring individual IAM policies for the ECS task role in the Application Account.
  4. D
    In the Compliance Account, configure the S3 bucket to allow public write access, and configure a customer managed KMS key. Configure the ECS tasks to write objects using the bucket-owner-full-control canned ACL, and configure the S3 bucket policy to trust the Application Account's root user, omitting specific IAM permissions for the ECS task role in the Application Account.

Answer

Configure the S3 bucket's Object Ownership setting to Bucket Owner Enforced, create a customer managed KMS key in the Compliance Account with key policies allowing cross-account access, update the bucket policy to permit writing from the ECS task role, and configure the ECS task role with matching S3 and KMS permissions.
The correct solution uses S3 Object Ownership set to Bucket Owner Enforced to disable ACLs and transfer object ownership directly to the Compliance Account. It implements a customer managed KMS key because AWS-managed keys cannot be shared across accounts. It configures permissions on both the destination resources (S3 bucket policy and KMS key policy) and the source identity (ECS task role) to allow the write operation, which is the required configuration for cross-account IAM access.

Step-by-Step Solution

1
Configure S3 Object Ownership in the Compliance Account.
S3 Object Ownership is set to Bucket Owner Enforced.
This automatically disables S3 ACLs and ensures that the Compliance Account owns all objects written to the bucket by external accounts.
2
Create and configure a Customer Managed Key (CMK) in the Compliance Account.
A CMK is created with a key policy allowing the ECS task role in the Application Account to perform kms:GenerateDataKey and kms:Decrypt, and auditors in the Compliance Account to perform kms:Decrypt.
AWS-managed keys (aws/s3) cannot be shared across accounts. A customer managed key allows custom policies to delegate cross-account access. The ECS task role needs kms:Decrypt to support multi-part uploads with KMS encryption.
3
Configure the S3 bucket policy in the Compliance Account.
The bucket policy allows the ECS task role ARN to perform s3:PutObject.
Cross-account access to S3 requires the bucket policy in the destination account to explicitly trust the external principal.
4
Attach a local IAM policy to the ECS task role in the Application Account.
The ECS task role is granted permission to perform s3:PutObject on the S3 bucket and kms:GenerateDataKey and kms:Decrypt on the CMK.
For cross-account access, permissions must be granted in both the destination resource policy (S3 bucket policy and KMS key policy) and the source identity policy (ECS task role IAM policy).

Key Concept

Cross-account access to S3 buckets encrypted with AWS KMS customer managed keys, using Bucket Owner Enforced to simplify object ownership.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic