Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

A smart-grid utility company is implementing a centralized telemetry data ingestion pipeline. Smart meter telemetry data is ingested in real-time in the Ingestion Account (Account ID 111122223333) via an Amazon Kinesis Data Firehose delivery stream. The compliance guidelines require all telemetry data to be stored long-term in an Amazon S3 bucket within a dedicated Security and Compliance Account (Account ID 444455556666). All data stored in the S3 bucket must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) owned by the Security and Compliance Account. The Kinesis Data Firehose delivery stream must write the data directly to the cross-account S3 bucket.

Which two configurations must the solutions architect implement to enable this cross-account delivery while satisfying the security and encryption requirements? (Select TWO.)

  1. Configure the KMS key policy of the Customer Managed Key in Account 444455556666 to grant the Kinesis Data Firehose IAM role in Account 111122223333 permissions for the kms:GenerateDataKey and kms:Decrypt actions.Answer
  2. Configure the S3 bucket policy in Account 444455556666 to grant the Kinesis Data Firehose IAM role in Account 111122223333 permission for the s3:PutObject action, and configure the Firehose delivery stream to apply the bucket-owner-full-control canned ACL.Answer
  3. C
    Configure the Kinesis Data Firehose delivery stream to encrypt the data using the default AWS-managed S3 key (aws/s3) in Account 444455556666, and add a bucket policy in Account 444455556666 that grants Account 111122223333 root access.
  4. D
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account 111122223333 that allows the s3:PutObject and kms:GenerateDataKey actions targeting the S3 bucket and KMS key in Account 444455556666.
  5. E
    Configure the S3 bucket policy in Account 444455556666 to trust the IAM role in Account 111122223333, and rely on the default S3 bucket key configuration to automatically handle cross-account KMS decryption without modifying the KMS key policy.

Answer

The correct configurations are to configure the KMS key policy of the Customer Managed Key in the Security and Compliance Account to allow the Firehose IAM role the kms:GenerateDataKey and kms:Decrypt actions, and to configure the S3 bucket policy in the Security and Compliance Account to allow the Firehose IAM role the s3:PutObject action along with using the bucket-owner-full-control canned ACL.
The correct solution requires configuring permissions at both the S3 bucket level and the KMS key level. First, the KMS key policy of the Customer Managed Key (CMK) in the Security and Compliance Account must grant the cross-account Firehose IAM role permissions to generate data keys and decrypt. Second, the S3 bucket policy in the Security and Compliance Account must permit the Firehose IAM role to put objects, and the Firehose delivery stream must specify the 'bucket-owner-full-control' canned ACL to delegate object ownership to the destination bucket owner.

Step-by-Step Solution

1
Analyze cross-account encryption requirements
Identify that Kinesis Data Firehose in the Ingestion Account needs access to the Customer Managed Key (CMK) in the Security and Compliance Account.
AWS-managed keys cannot be shared across accounts, meaning a Customer Managed Key must be used, and its key policy must explicitly authorize the external Firehose IAM role.
2
Determine necessary KMS key policy permissions
The KMS key policy in the Security and Compliance Account must include a statement granting kms:GenerateDataKey and kms:Decrypt to the Firehose IAM role ARN.
Firehose requires kms:GenerateDataKey to encrypt data before writing to S3, and kms:Decrypt is required to verify key permissions.
3
Determine S3 bucket policy and ownership configuration
The S3 bucket policy in the Security and Compliance Account must allow the Firehose IAM role to perform s3:PutObject, and Firehose must specify the bucket-owner-full-control canned ACL.
Without the bucket-owner-full-control ACL, the uploaded objects would be owned by the Ingestion Account, preventing the Security and Compliance Account from reading or managing the data.

Key Concept

Cross-account access delegation for S3 buckets encrypted with KMS Customer Managed Keys (CMKs)
Estimated Time:3m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic