Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A company is developing a new regulatory reporting system. The application runs on Amazon ECS tasks in an Application account (Account ID: 123456789012). The system must write weekly reports to an Amazon S3 bucket located in a dedicated Compliance account (Account ID: 987654321098). The reports must be encrypted at rest using AWS KMS. The compliance team requires that the encryption key's access policy is managed under the Compliance account, and only the reporting application is authorized to perform encryption operations. Which design should a Solutions Architect recommend to meet these requirements securely?

  1. In the Compliance account, create a Customer Managed Key (CMK). Configure the CMK's key policy to grant the ECS task role in the Application account permissions to perform kms:GenerateDataKey. Update the S3 bucket policy in the Compliance account to allow the ECS task role to perform s3:PutObject. Configure the ECS task role with IAM policies allowing s3:PutObject on the bucket and kms:GenerateDataKey on the CMK.Answer
  2. B
    In the Compliance account, enable default S3 bucket encryption using the AWS-managed KMS key (aws/s3). Configure the S3 bucket policy in the Compliance account to allow the ECS task role in the Application account to perform s3:PutObject. Configure the ECS task role with IAM policies allowing s3:PutObject on the bucket and kms:GenerateDataKey on the AWS-managed key.
  3. C
    In the Compliance account, create a Customer Managed Key (CMK). Attach a Service Control Policy (SCP) to the Organizational Unit containing the Application account that grants the ECS task role permissions to perform kms:GenerateDataKey on the CMK in the Compliance account. Configure the S3 bucket policy to allow the Application account's ECS task role to perform s3:PutObject.
  4. D
    In the Compliance account, create a Customer Managed Key (CMK). Configure the S3 bucket policy in the Compliance account to allow the ECS task role to perform s3:PutObject and kms:GenerateDataKey. Configure the ECS task role with an IAM policy that allows s3:PutObject on the S3 bucket.

Answer

In the Compliance account, create a Customer Managed Key (CMK). Configure the CMK's key policy to grant the ECS task role in the Application account permissions to perform kms:GenerateDataKey. Update the S3 bucket policy in the Compliance account to allow the ECS task role to perform s3:PutObject. Configure the ECS task role with IAM policies allowing s3:PutObject on the bucket and kms:GenerateDataKey on the CMK.
The correct design uses a Customer Managed Key (CMK) in the Compliance account and explicitly grants the Application account's ECS task role permission to perform the kms:GenerateDataKey operation. Because the S3 bucket and the KMS key are in a different account than the ECS task, the cross-account permissions must be granted on both the resource policies (S3 bucket policy and KMS key policy) and the ECS task role's IAM policy.

Step-by-Step Solution

1
Select the correct key type for cross-account operations.
Choose a Customer Managed Key (CMK) in the Compliance account because AWS-managed keys cannot be shared cross-account.
AWS-managed keys do not allow policy modifications, which are required to add the external Application account principal.
2
Configure the key policy for the Customer Managed Key.
Add a statement in the CMK policy that allows the ECS task role in the Application account to perform the kms:GenerateDataKey operation.
When writing to S3 with SSE-KMS, the caller must have the permission to generate a data key from the KMS key.
3
Configure the S3 bucket policy and IAM permissions.
Add a statement in the S3 bucket policy allowing s3:PutObject for the ECS task role, and ensure the ECS task role's IAM policy allows s3:PutObject and kms:GenerateDataKey.
Cross-account access requires permissions to be granted on both the trust resource policy (bucket policy/key policy) and the caller's identity-based policy (IAM policy).

Key Concept

Cross-account S3 access with KMS encryption requires Customer Managed Keys (CMKs) and correct alignment of both IAM policies and resource policies (S3 bucket and KMS key policies).
Estimated Time:2m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic