Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

A multinational enterprise is building a financial transaction platform using a multi-account structure in AWS Organizations. The application tier runs on Amazon EC2 instances in an Application account (account 444455556666). The transaction logs must be stored in a secured Amazon S3 bucket within the Application account. A compliance mandate dictates that all logs must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) hosted and managed centrally in a dedicated Security account (account 111122223333). Additionally, the system must reject any write operation to the S3 bucket if the data is not encrypted with the specified cross-account CMK. Which combination of actions should the Solutions Architect take to meet these compliance and security requirements? (Select TWO.)

  1. In the Security account, configure a Customer Managed Key key policy that grants the Application account root principal (arn:aws:iam::444455556666:root) permissions to perform kms:GenerateDataKey* and kms:Decrypt. In the Application account, attach an IAM policy to the EC2 instance profile's IAM role allowing these same KMS actions on the CMK ARN.Answer
  2. In the Application account, configure an S3 bucket policy that denies the s3:PutObject action unless the s3:x-amz-server-side-encryption-aws-kms-key-id request header matches the ARN of the KMS CMK in the Security account. In the Application account, grant the EC2 instance profile's IAM role permission to perform s3:PutObject on the S3 bucket.Answer
  3. C
    In the Security account, configure the AWS-managed KMS key for S3 (aws/s3) to grant usage permissions to the Application account root principal. In the Application account, configure the EC2 instance profile's IAM role to encrypt S3 uploads using this AWS-managed key.
  4. D
    Create a Service Control Policy (SCP) at the Organizational Unit (OU) level containing both accounts that explicitly permits the Application account's EC2 instances to perform kms:GenerateDataKey* and kms:Decrypt actions on the key ARN. Rely on this SCP to authorize the cross-account encryption without updating the key policy or local IAM policies.
  5. E
    In the Application account, configure the S3 bucket policy to trust the Security account root principal as the sole writer, and implement a bucket policy condition requiring s3:x-amz-server-side-encryption to be set to AES256 while leaving KMS authorization to be managed solely by AWS IAM roles in the Security account.

Answer

The correct combination of actions is to configure a Customer Managed Key key policy in the Security account allowing the Application account root principal to perform key operations while attaching a corresponding local IAM policy to the EC2 instances, and to apply an S3 bucket policy in the Application account that denies writes without the designated KMS CMK ARN header.
The correct solution involves two main aspects of security control design: cross-account KMS usage and encryption enforcement. The option configuring a Customer Managed Key key policy to trust the Application account root principal combined with local IAM policies correctly implements the required cross-account KMS trust. The option implementing an S3 bucket policy that denies s3:PutObject requests unless the CMK ARN header is specified ensures compliance is enforced at the bucket level.

Step-by-Step Solution

1
Delegate cross-account KMS access from the owning account.
The KMS key policy in the Security account is modified to include the Application account root principal as an authorized entity for cryptographic operations.
KMS requires explicit delegation in the key policy for cross-account access before the target account can use IAM to assign permissions to individual roles.
2
Grant local identity-based permissions for the cross-account KMS key.
The IAM role assigned to the EC2 instances in the Application account is updated with permissions to perform kms:GenerateDataKey* and kms:Decrypt on the external CMK ARN.
Cross-account access requires a two-way handshake: trust in the resource policy (key policy) and permission in the identity policy (IAM policy).
3
Enforce encryption compliance via S3 bucket policies.
A bucket policy is applied to the S3 bucket in the Application account to deny any s3:PutObject operation if the encryption key used does not match the specific KMS CMK ARN.
This guarantees that even with correct IAM permissions, objects cannot be written unless they adhere to the mandated encryption controls.

Key Concept

Cross-account AWS KMS key access requires trust delegation in the Customer Managed Key's policy to the consumer account's root principal, followed by identity-based IAM policies in the consumer account. To enforce specific encryption requirements, S3 bucket policies must check condition keys such as s3:x-amz-server-side-encryption-aws-kms-key-id.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic