Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A financial services company is designing a new solution on AWS. They need to store sensitive audit logs in an Amazon S3 bucket in a dedicated security account (111122223333). These logs must be encrypted at rest. A partner application running in a separate AWS account (444455556666) requires daily read access to these logs. The company must implement a secure access mechanism that allows cross-account read access to the encrypted logs, adhering to the principle of least privilege. Which two configuration steps are required to establish this cross-account access? (Select TWO.)

  1. Configure the S3 bucket policy in the security account (111122223333) to allow s3:GetObject and s3:ListBucket permissions for the IAM role in the partner account (444455556666).Answer
  2. Configure the key policy of a Customer Managed Key (CMK) in the security account (111122223333) to grant kms:Decrypt and kms:DescribeKey permissions to the IAM role in the partner account (444455556666).Answer
  3. C
    Encrypt the S3 bucket in the security account using the default AWS managed key (aws/s3) and delegate decryption permissions via the partner account's local IAM policy.
  4. D
    Attach a Service Control Policy (SCP) to the organizational unit containing the security account to explicitly grant cross-account read access and decrypt permissions to the partner account (444455556666).
  5. E
    Configure the S3 bucket policy in the partner account (444455556666) to pull logs from the security account (111122223333) and enable cross-account access.

Answer

Configure the S3 bucket policy in the security account to allow access to the partner's IAM role, and configure the key policy of a Customer Managed Key (CMK) in the security account to grant decrypt permissions to the partner's IAM role.
To establish cross-account access to encrypted S3 objects, the owning account must explicitly grant permissions on both the S3 bucket and the KMS key. The S3 bucket policy in the security account must allow s3:GetObject and s3:ListBucket for the partner role principal. Furthermore, because default key policies do not allow cross-account access and AWS managed keys cannot be modified, a Customer Managed Key (CMK) must be used. The CMK's key policy must be updated to grant kms:Decrypt and kms:DescribeKey permissions to the partner role.

Step-by-Step Solution

1
Ensure the S3 bucket is encrypted using a Customer Managed Key (CMK) rather than an AWS managed key.
This allows the key policy to be customized for cross-account access.
AWS managed keys do not support policy modification and cannot be shared across accounts.
2
Add a statement to the S3 bucket policy in the security account (111122223333) targeting the partner's IAM role ARN from account 444455556666.
Grants the external role permission to list and get objects from the bucket.
Cross-account S3 access requires explicit authorization from the resource owner via a bucket policy.
3
Modify the KMS key policy of the CMK in the security account (111122223333) to allow the partner's IAM role to perform kms:Decrypt and kms:DescribeKey actions.
Authorizes the external role to decrypt the data when retrieving objects.
Without KMS key policy delegation, cross-account calls to decrypt the objects will fail.

Key Concept

Cross-account resource access with KMS encryption requires explicit delegation in both the resource policy (S3 bucket policy) and the encryption key policy (KMS CMK policy), as AWS managed keys cannot be shared cross-account.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic