Examkin

Question

Difficulty: HardEnhancing Data Protection and Compliance

A media streaming company has an existing logging pipeline that aggregates user viewing history logs from application servers running in multiple member accounts within AWS Organizations. These logs are stored in a centralized Amazon S3 bucket in a dedicated compliance archive account. A solutions architect must enhance the data protection and compliance posture of this pipeline. The compliance requirements mandate:

- All logs must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS with annual rotation.
- Access to encrypt and decrypt the logs must be strictly controlled and audited.
- The configuration must minimize the KMS API request costs associated with the high volume of write operations.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create a customer-managed KMS key in the compliance archive account. Update the key policy to grant key generation permissions to the IAM principals in the member accounts, and enable S3 Bucket Keys on the destination S3 bucket.Answer
  2. Update the S3 bucket policy in the compliance archive account to deny any write requests that do not specify server-side encryption with AWS KMS (SSE-KMS) and do not use the ARN of the compliance archive account's customer-managed KMS key.Answer
  3. C
    Use the AWS-managed KMS key in the compliance archive account to encrypt the objects, and update its key policy to allow cross-account access from the member accounts.
  4. D
    Create a customer-managed KMS key in each member account, configure cross-account access to the archive S3 bucket, and rely on the S3 bucket's default encryption configuration using the member accounts' KMS keys.
  5. E
    Apply a Service Control Policy (SCP) at the root of the AWS Organization that grants key generation and decryption access to the compliance archive S3 bucket for all member accounts, eliminating the need to update individual KMS key policies.

Answer

The correct actions are: creating a customer-managed KMS key in the compliance archive account, enabling S3 Bucket Keys on the destination S3 bucket, and updating the S3 bucket policy to deny uploads that do not use the compliance archive account's customer-managed KMS key.
The correct solution involves creating a customer-managed KMS key in the compliance archive account and granting access to the member accounts. This meets compliance and cross-account requirements. To minimize costs, S3 Bucket Keys should be enabled to cache data keys and reduce KMS API requests. Finally, the S3 bucket policy should be updated with a Deny statement to block any uploads that do not use the customer-managed key.

Step-by-Step Solution

1
Determine the appropriate type of key to support cross-account access.
A customer-managed KMS key must be selected because AWS-managed keys cannot be shared or have their key policies modified for cross-account access.
To comply with the requirement that the compliance key can be used across member accounts.
2
Address the requirement to minimize KMS API request costs under a high write volume.
Enable Amazon S3 Bucket Keys on the destination S3 bucket.
S3 Bucket Keys decrease the traffic from Amazon S3 to AWS KMS by caching bucket-level keys, thereby reducing the number of GenerateDataKey calls and associated costs.
3
Configure S3 bucket policy enforcement to ensure data protection compliance.
Apply a bucket policy that denies any s3:PutObject requests unless they include the SSE-KMS header and target the compliance archive account's KMS key.
This acts as a guardrail to ensure that only properly encrypted objects are stored in the bucket.

Key Concept

Enhancing S3 data protection using centralized customer-managed KMS keys, cross-account policies, and S3 Bucket Keys for cost optimization.
Estimated Time:3m 0s
Rate this question

Topics

Enhancing Data Protection and Compliance