Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A telemetry collection system running on Amazon EC2 instances in Account A needs to publish environment alerts to an Amazon SNS topic in Account B. To meet internal security and compliance policies, the SNS topic must be encrypted at rest. The Solutions Architect needs to design a secure, least-privilege configuration to allow the instances in Account A to publish to the topic in Account B. Which configuration will allow the EC2 instances in Account A to publish to the SNS topic in Account B while maintaining encryption?

  1. Configure the SNS topic in Account B to use a Customer Managed Key (CMK). Update the KMS key policy in Account B to grant the EC2 instance profile role in Account A permissions for the kms:GenerateDataKey and kms:Decrypt actions. Update the SNS topic policy in Account B to allow the sns:Publish action for the EC2 instance profile role in Account A.Answer
  2. B
    Configure the SNS topic in Account B to use the default AWS-managed KMS key for Amazon SNS (aws/sns). Update the IAM policy of the EC2 instance profile role in Account A to allow the sns:Publish action on the topic and the kms:GenerateDataKey action on the aws/sns key.
  3. C
    Configure the SNS topic in Account B to use a Customer Managed Key (CMK). Create a Service Control Policy (SCP) at the organizational unit (OU) level containing both accounts that allows the kms:GenerateDataKey and kms:Decrypt actions for Account A's root user principal, and rely on this SCP to delegate access without modifying the KMS key policy.
  4. D
    Configure the EC2 instance profile in Account A to assume a cross-account IAM role in Account B to publish to the SNS topic. In Account B, configure the IAM role trust policy using sts:AssumeRoleWithWebIdentity but specify Account A's account root as the principal instead of an OIDC provider.

Answer

Configure the SNS topic in Account B to use a Customer Managed Key (CMK), update the KMS key policy in Account B to grant the EC2 instance profile role in Account A permissions for the kms:GenerateDataKey and kms:Decrypt actions, and update the SNS topic policy in Account B to allow the sns:Publish action for the EC2 instance profile role in Account A.
The correct configuration uses a Customer Managed Key (CMK) in the target account (Account B) and updates its key policy to allow the publishing role in Account A to perform kms:GenerateDataKey and kms:Decrypt. Combined with updating the SNS topic policy to permit sns:Publish from the Account A role, this satisfies least-privilege and security requirements.

Step-by-Step Solution

1
Select the correct encryption key type.
A Customer Managed Key (CMK) in Account B is chosen instead of the default AWS-managed KMS key.
AWS-managed keys do not support key policy modifications, making them unusable for cross-account access scenarios.
2
Configure the KMS key policy.
The key policy of the CMK in Account B is updated to grant kms:GenerateDataKey and kms:Decrypt to the IAM role from Account A.
The publisher in Account A needs to generate a data key to encrypt the messages before they are processed by SNS.
3
Configure the SNS topic policy.
The resource-based policy of the SNS topic in Account B is updated to allow sns:Publish for the Account A IAM role.
Cross-account access to Amazon SNS requires explicit permission in the destination resource policy.

Key Concept

Cross-account encryption permissions using KMS Customer Managed Keys
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic