Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

CloudSentry Solutions is designing a new medical archiving system. The application runs on AWS Fargate inside a private subnet in an Application Account. The Fargate tasks need to write processed medical records directly to a centralized Amazon S3 bucket located in a dedicated Compliance Account. All data written to the S3 bucket must be encrypted at rest using SSE-KMS. Which of the following configurations should the solutions architect recommend to satisfy these requirements securely?

  1. A
    Use the default AWS-managed S3 key (`aws/s3`) in the Compliance Account to encrypt the bucket, and configure the S3 bucket policy in the Compliance Account to allow the Fargate execution IAM role in the Application Account to perform `s3:PutObject` operations.
  2. Create a customer managed key in the Compliance Account. Configure the KMS key policy to grant `kms:GenerateDataKey` permissions to the Fargate execution IAM role in the Application Account. Configure the S3 bucket policy in the Compliance Account to allow `s3:PutObject` permissions for the Fargate execution IAM role, and configure the Fargate task to use the compliance key for encryption.Answer
  3. C
    Create a customer managed key in the Compliance Account. Attach a Service Control Policy (SCP) to the Application Account's Organizational Unit (OU) that explicitly grants `s3:PutObject` and `kms:GenerateDataKey` permissions to the Fargate execution IAM role, eliminating the need to update the S3 bucket policy or the KMS key policy in the Compliance Account.
  4. D
    Create a customer managed key in the Compliance Account. Configure the KMS key policy to grant `kms:GenerateDataKey` permissions to the Fargate execution IAM role in the Application Account, but do not modify the S3 bucket policy in the Compliance Account, relying on the KMS key policy permissions to authorize the cross-account write operations.

Answer

Create a customer managed key in the Compliance Account, configure the KMS key policy to grant `kms:GenerateDataKey` to the Fargate execution IAM role in the Application Account, and configure the S3 bucket policy to allow `s3:PutObject` for the role.
The correct solution involves creating a Customer Managed Key (CMK) in the Compliance Account. A CMK is required because its policy can be modified to grant cross-account permissions. To allow the Fargate tasks in the Application Account to upload objects, the CMK policy must grant `kms:GenerateDataKey` to the Fargate execution role, and the S3 bucket policy must allow `s3:PutObject` for the same role.

Step-by-Step Solution

1
Select the correct KMS key type.
Avoid using the default AWS-managed KMS key (`aws/s3`) since it does not support cross-account access, and opt for a Customer Managed Key (CMK) in the Compliance Account.
AWS-managed KMS key policies cannot be modified to add cross-account trust.
2
Configure the Customer Managed Key policy in the Compliance Account.
Add a statement in the CMK policy that grants `kms:GenerateDataKey` permissions to the ARN of the Fargate task execution IAM role in the Application Account.
This enables the Fargate task to request a data key from KMS to encrypt the object during upload.
3
Configure the S3 bucket policy in the Compliance Account.
Add a statement in the S3 bucket policy that allows the `s3:PutObject` action, specifying the Fargate task execution IAM role as the principal.
Cross-account access to S3 buckets requires explicit authorization from the bucket owner via a bucket policy.

Key Concept

Cross-account access to S3 buckets encrypted with SSE-KMS requires using a Customer Managed Key and explicitly granting permissions on both the S3 bucket policy and the KMS key policy.
Estimated Time:1m 30s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic