Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A healthcare provider is deploying a centralized vulnerability scanner in a dedicated Audit account. The scanner must read raw medical record files stored in an Amazon S3 bucket within a separate Operations account. The files are encrypted with server-side encryption using AWS KMS (SSE-KMS). The scanner runs as a containerized task on AWS Fargate in the Audit account, using an IAM task role named AuditScannerRole.

Which configuration strategy should a solutions architect implement to allow AuditScannerRole to decrypt and retrieve these files?

  1. Set the S3 bucket in the Operations account to encrypt objects with a customer managed KMS key. Modify the key policy of this customer managed key to allow the Audit account to perform kms:Decrypt actions. Grant AuditScannerRole IAM permissions for s3:GetObject on the bucket and kms:Decrypt on the key, and update the Operations bucket policy to allow the AuditScannerRole s3:GetObject access.Answer
  2. B
    Use the AWS managed key (aws/s3) to encrypt the S3 bucket in the Operations account. In the Audit account, attach an IAM policy to AuditScannerRole that grants s3:GetObject permissions on the Operations S3 bucket and kms:Decrypt permissions on the aws/s3 key ARN from the Operations account.
  3. C
    Set the S3 bucket in the Operations account to encrypt objects with a customer managed KMS key. Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing both accounts that explicitly grants AuditScannerRole permissions to perform kms:Decrypt on the key and s3:GetObject on the bucket.
  4. D
    Set the S3 bucket in the Operations account to encrypt objects with a customer managed KMS key. Have the scanner container assume an IAM role in the Operations account to read the files, but configure the trust policy of the Operations IAM role to trust the Audit account without specifying the sts:AssumeRole action in the statement.

Answer

Configure the S3 bucket to use a customer managed KMS key, modify the key policy of this key to delegate kms:Decrypt access to the Audit account, grant the AuditScannerRole IAM permissions to read the bucket and decrypt using the key, and update the bucket policy in the Operations account to grant s3:GetObject permissions to the AuditScannerRole.
To decrypt and access S3 objects across accounts, you must use a customer managed KMS key. The KMS key policy in the Operations account must delegate decrypt permissions to the Audit account (or specifically the scanner role). Additionally, the resource policies (KMS key policy and S3 bucket policy) and the identity-based IAM policy in the Audit account must all align to grant the necessary read and decrypt access.

Step-by-Step Solution

1
Ensure the S3 bucket in the Operations account is encrypted using a customer managed KMS key instead of the default AWS managed key (aws/s3).
The bucket uses a key whose policy can be modified to allow cross-account access.
AWS managed KMS keys do not allow policy modifications, making them unusable for cross-account access.
2
Update the customer managed key policy in the Operations account to grant the Audit account root principal or the specific AuditScannerRole permission to perform kms:Decrypt.
The KMS key permits cross-account decryption requests from the Audit account.
By default, KMS keys restrict cross-account access unless explicitly configured in the key policy.
3
Add an S3 bucket policy statement to the Operations account bucket that allows s3:GetObject permissions for the AuditScannerRole principal.
The S3 bucket allows cross-account read access.
For cross-account S3 access, the resource-based bucket policy must explicitly permit the external IAM principal.
4
Attach an IAM policy to the AuditScannerRole in the Audit account granting s3:GetObject permissions on the Operations bucket and kms:Decrypt permissions on the Operations KMS key.
The scanner task has the required identity-based permissions to request decryption and read the object.
Cross-account access requires permissions to be granted on both the resource side (bucket policy and KMS key policy) and the identity side (IAM policy).

Key Concept

Cross-account Amazon S3 access with KMS encryption requires a customer managed key, delegating decryption permissions in the KMS key policy, allowing read access in the S3 bucket policy, and granting identity-based permissions in the consumer account.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic