Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

Apex Cargo Systems is designing a new cloud architecture. An application hosted on Amazon ECS tasks in the Operations account (Account 111122223333111122223333) must write transactional log files to an Amazon S3 bucket located in the Compliance Archive account (Account 444455556666444455556666). The logs must be encrypted at rest using an AWS KMS key managed by the Compliance team. The solution must ensure that files written to the bucket are encrypted and that the Operations account has the minimum necessary privileges to perform these writes.

Which combination of configuration steps will satisfy these security and compliance design requirements?

  1. A
    Use the AWS-managed key `aws/s3` in the Compliance Archive account to encrypt the S3 bucket. Configure the S3 bucket policy to allow the Operations account's ECS task role to perform `s3:PutObject`. In the Operations account, configure the ECS task role's IAM policy to allow `s3:PutObject` on the S3 bucket and `kms:GenerateDataKey` on the `aws/s3` key.
  2. B
    Create a Customer Managed Key (CMK) in the Compliance Archive account. Create a Service Control Policy (SCP) at the Organization level that allows the Operations account's ECS task role to write to the S3 bucket and use the CMK. Apply the SCP to both accounts to delegate permissions without modifying individual resource policies.
  3. Create a Customer Managed Key (CMK) in the Compliance Archive account. Configure the CMK key policy to allow the Operations account's ECS task role to perform `kms:GenerateDataKey` and `kms:Decrypt` actions. In the Compliance Archive account, configure the S3 bucket policy to allow `s3:PutObject` from the Operations account's ECS task role. In the Operations account, configure the ECS task role's IAM policy to allow `s3:PutObject` on the destination S3 bucket and `kms:GenerateDataKey` on the CMK.Answer
  4. D
    Create a Customer Managed Key (CMK) in the Compliance Archive account. Configure the CMK key policy to allow the Operations account's ECS task role to perform `kms:GenerateDataKey` and `kms:Decrypt`. In the Compliance Archive account, configure the S3 bucket policy to allow `s3:PutObject` from the Operations AWS account's root principal (`arn:aws:iam::111122223333:root`), but do not assign any S3 write permissions to the ECS task role's IAM policy, relying on the bucket policy to grant direct access.

Answer

Create a Customer Managed Key (CMK) in the Compliance Archive account, authorizing the Operations account's ECS task role in its key policy. Configure the destination S3 bucket policy to allow writes from the same ECS task role, and configure the ECS task role's local IAM policy to allow writes to the destination bucket and key generation on the CMK.
The correct option correctly uses a Customer Managed Key (CMK), since AWS-managed KMS keys cannot be shared across accounts. It also establishes permissions on both sides of the trust boundary: the destination resource policies (S3 bucket policy and KMS key policy) permit access from the source identity, and the source identity's IAM policy allows it to perform the actions on those target resources.

Step-by-Step Solution

1
Select a Customer Managed Key (CMK) over an AWS-managed KMS key for encryption.
Allows customizing the key policy to support cross-account usage, which is impossible with AWS-managed keys like `aws/s3`.
AWS-managed keys cannot be shared across accounts as their key policies cannot be modified.
2
Configure the CMK key policy to grant usage permissions to the Operations account's ECS task role.
Enables the external ECS task role to perform `kms:GenerateDataKey` and `kms:Decrypt` required for S3 upload encryption.
AWS KMS requires explicit cross-account permissions in the key policy for external principals to use the key.
3
Configure the S3 bucket policy in the Compliance Archive account.
Grants the Operations account's ECS task role permission to upload objects via `s3:PutObject`.
Cross-account S3 access requires the destination resource policy to explicitly allow the source identity.
4
Configure the source IAM policy on the ECS task role in the Operations account.
Gives the ECS task role local permission to access the remote bucket and KMS key.
For cross-account access, permissions must be enabled on both the target resource policy and the source IAM identity policy.

Key Concept

Cross-account resource sharing utilizing KMS Customer Managed Keys, S3 Bucket Policies, and IAM Identity Policies.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic