Examkin

Question

Difficulty: MediumEnhancing Data Protection and Compliance

A retail corporation runs a transaction processing application on Amazon EC2 instances in an application AWS account. The application must archive transaction logs to an Amazon S3 bucket located in a centralized compliance AWS account. The compliance team requires that all logs are encrypted at rest using AWS Key Management Service (AWS KMS). The solutions architect configures default bucket encryption using the AWS-managed key for Amazon S3 (aws/s3). When the application tries to upload objects to the archive bucket, it receives access denied errors. How should the solutions architect resolve this issue to allow the application to archive logs securely?

  1. A
    Modify the key policy of the AWS-managed key aws/s3 in the compliance account to add the application's IAM role from the application account as a key user.
  2. B
    Create a Service Control Policy (SCP) in AWS Organizations that allows the kms:GenerateDataKey action for the application's IAM role, and attach it to the organizational unit containing both accounts.
  3. Configure the S3 bucket in the compliance account to use a customer managed key. Update the customer managed key's policy in the compliance account to grant the application's IAM role permission to generate data keys.Answer
  4. D
    Update the S3 bucket policy in the compliance account to delegate decryption and encryption permissions for the AWS-managed key aws/s3 to the application account's root principal.

Answer

Configure the S3 bucket in the compliance account to use a customer managed key and update its key policy to grant the application's IAM role permission to generate data keys.
To resolve the cross-account encryption issue, the S3 bucket must use a Customer Managed Key (CMK) instead of the default AWS-managed key. Because key policies of AWS-managed keys cannot be altered, they cannot be shared across accounts. A customer managed key allows the destination account owner to edit the key policy, granting the application's IAM role in the source account the necessary permissions to generate data keys and encrypt objects during upload.

Step-by-Step Solution

1
Analyze the cause of the upload failure under cross-account S3 KMS encryption.
The application's IAM role lacks permission to use the KMS key defined for S3 default encryption.
By default, the bucket was configured with the AWS-managed key (aws/s3), which cannot be shared cross-account because its key policy cannot be modified.
2
Select the correct key type to allow cross-account access.
A Customer Managed Key (CMK) is created in the compliance account.
Customer managed keys allow policy modification, enabling the resource owner to grant usage permissions to identities in external AWS accounts.
3
Grant the application's IAM role the required KMS permissions.
The customer managed key policy is updated to allow the application's IAM role to perform kms:GenerateDataKey and kms:Decrypt.
When writing to an S3 bucket encrypted with SSE-KMS, the caller must have permission to generate data keys from the KMS key to encrypt the object.

Key Concept

Cross-account AWS KMS key policy delegation for Amazon S3 SSE-KMS encryption.
Rate this question

Topics

Enhancing Data Protection and Compliance