Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

TerraGrid Energy is designing a new compliance monitoring system. Application servers run under an IAM role in a Production Account (Account A) and need to write telemetry logs containing sensitive customer data to an Amazon S3 bucket located in a centralized Compliance Account (Account B). All logs must be encrypted at rest using an encryption key managed in Account B. The security team requires that the encryption key policy enforces the principle of least privilege. Which two actions should the solutions architect take to configure this security control? (Select TWO.)

  1. Create a customer managed key (CMK) in Account B, and configure the key policy to grant the IAM role in Account A permissions for the kms:GenerateDataKey and kms:Decrypt actions.Answer
  2. Configure the S3 bucket policy in Account B to allow the IAM role in Account A to perform the s3:PutObject action, and attach an IAM policy to the application role in Account A that grants access to the S3 bucket and the CMK in Account B.Answer
  3. C
    Use the default AWS-managed KMS key for Amazon S3 (aws/s3) in Account B, and configure Account A's IAM policy to reference this key for encryption during S3 uploads.
  4. D
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account A that allows cross-account S3 and KMS access, eliminating the need to attach local IAM policies to the application role in Account A.
  5. E
    Configure the S3 bucket policy in Account B to trust Account A using the aws:PrincipalOrgID condition, and omit the s3:PutObject permission from Account A's IAM policy to rely entirely on the bucket policy for authorization.

Answer

Create a customer managed key (CMK) in the compliance account (Account B), configure the key policy to grant the application's IAM role in Account A permissions for the kms:GenerateDataKey and kms:Decrypt actions, update the destination S3 bucket policy in Account B to allow the role to perform the s3:PutObject action, and attach an IAM policy to the role in Account A granting access to the S3 bucket and the CMK in Account B.
To secure cross-account S3 data writing with KMS encryption, a Customer Managed Key (CMK) must be created in the destination account because AWS-managed keys cannot be shared across accounts. The CMK's key policy must trust the source IAM role. Additionally, access must be authorized symmetrically: the destination bucket policy must permit the source IAM role, and the source IAM role must have an IAM policy allowing it to perform the upload and use the external CMK.

Step-by-Step Solution

1
Evaluate the key management requirements.
Determine that a Customer Managed Key (CMK) is required in the destination account because default AWS-managed KMS keys cannot have their key policies modified to allow cross-account access.
AWS-managed keys are limited to their own accounts and cannot support cross-account operations.
2
Configure cross-account key access.
Define a key policy on the CMK in Account B that explicitly lists the application's IAM role ARN from Account A as a principal allowed to perform cryptographic operations (kms:GenerateDataKey, kms:Decrypt).
The key policy is the primary policy evaluation point for KMS, and it must trust the cross-account role.
3
Configure cross-account S3 bucket access.
Define an S3 bucket policy in Account B that permits the specific application role in Account A to execute s3:PutObject.
For cross-account bucket access, the bucket owner must explicitly grant permissions to the external principal.
4
Configure client-side identity permissions in the source account.
Attach an IAM policy to the application's role in Account A that grants permissions to write to the Account B bucket and use the Account B CMK.
Cross-account access requires authorization on both the resource (bucket/key policy) and the identity (IAM policy).

Key Concept

Cross-account security controls involving S3 and KMS require authorization in the KMS key policy, the S3 bucket policy, and the client's local IAM policy, utilizing Customer Managed Keys (CMKs) to enable cross-account policy sharing.
Estimated Time:2m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic