Examkin

Question

Difficulty: Very hardStrengthening Identity, Access, and Network Security

An enterprise is strengthening the security posture of an existing data processing platform. The platform runs on Amazon EC2 instances in a private subnet of VPC-A in Account A. The instances must read large, sensitive datasets from an Amazon S3 bucket in Account B. The S3 bucket is encrypted using an AWS Key Management Service (AWS KMS) customer managed key (CMK) in Account B.

The security architect must enforce the following security requirements:
1. All data transit between VPC-A and the S3 bucket must stay within the AWS network and must not traverse the public internet.
2. The S3 bucket must only accept requests that originate from the specific VPC endpoint created in VPC-A for S3.
3. Access to the S3 bucket and the KMS key must be granted based on the principle of least privilege to the EC2 instances' IAM role in Account A.

Which combination of configurations will meet these security requirements?

  1. In VPC-A, deploy an S3 Interface Endpoint with Private DNS enabled. Attach an endpoint policy to it that allows the IAM role in Account A to perform s3:GetObject on the bucket in Account B. In Account A, attach an IAM policy to the EC2 instances' role allowing s3:GetObject on the bucket in Account B and kms:Decrypt on the CMK in Account B. In Account B, configure the KMS key policy of the CMK to allow the IAM role in Account A to perform kms:Decrypt. Configure the S3 bucket policy to allow the IAM role in Account A to perform s3:GetObject only when the request condition aws:sourceVpce matches the ID of the S3 Interface Endpoint.Answer
  2. B
    In VPC-A, deploy an S3 Interface Endpoint with Private DNS enabled. Attach an endpoint policy to it that allows the IAM role in Account A to perform s3:GetObject on the bucket in Account B. In Account A, attach an IAM policy to the EC2 instances' role allowing s3:GetObject on the bucket in Account B. In Account B, configure the S3 bucket default encryption to use the AWS managed key (aws/s3). Update the key policy of aws/s3 to allow the IAM role in Account A to perform kms:Decrypt. Configure the S3 bucket policy to allow the IAM role in Account A to perform s3:GetObject only when the request condition aws:sourceVpce matches the ID of the S3 Interface Endpoint.
  3. C
    Create a Service Control Policy (SCP) at the AWS Organizations root that explicitly allows the IAM role in Account A to perform s3:GetObject on the bucket in Account B and kms:Decrypt on the KMS key in Account B. In VPC-A, deploy an S3 Gateway Endpoint and associate it with the route tables of the private subnets. In Account B, configure the S3 bucket policy to allow the IAM role in Account A to perform s3:GetObject only when the request condition aws:sourceVpc matches the VPC ID of VPC-A.
  4. D
    In VPC-A, deploy an S3 Interface Endpoint and disable Private DNS. Create a Route 53 Private Hosted Zone for s3.us-east-1.amazonaws.com in Account B, associate it with VPC-A, and create an Alias record pointing to the DNS name of the VPC endpoint. In Account A, attach an IAM policy to the EC2 instances' role allowing s3:GetObject on the bucket in Account B and kms:Decrypt on the CMK in Account B. In Account B, configure the KMS key policy of the CMK to allow the S3 VPC Endpoint service principal (vpce.amazonaws.com) to perform kms:Decrypt. Configure the S3 bucket policy to allow the IAM role in Account A to perform s3:GetObject only when the request condition aws:sourceVpce matches the ID of the S3 Interface Endpoint.

Answer

Deploy an S3 Interface Endpoint with Private DNS enabled, and configure the local IAM policy, the target S3 bucket policy (conditioned on the VPC endpoint using aws:sourceVpce), the custom KMS key policy to trust the cross-account role, and the endpoint policy to allow access.
The correct configuration uses an S3 Interface Endpoint with Private DNS enabled to keep traffic internal. Cross-account access to KMS-encrypted objects requires a Customer Managed Key (CMK) because its key policy can be modified to grant the external IAM role decryption rights. The local IAM policy must allow the access, the S3 endpoint policy must permit the S3 actions, and the S3 bucket policy must restrict access to the specific VPC endpoint using the aws:sourceVpce condition to enforce that all traffic goes through the private endpoint.

Step-by-Step Solution

1
Analyze key configuration constraints for cross-account S3 access with KMS encryption.
Identify that the default AWS managed key (aws/s3) cannot be used for cross-account decryption because its key policy is immutable. A Customer Managed Key (CMK) in the destination account must be configured.
AWS-managed KMS keys do not support policy modifications, which are mandatory to trust an IAM principal from a different AWS account.
2
Determine the correct network routing and access control configuration.
Deploy an S3 Interface Endpoint (PrivateLink) with Private DNS enabled to ensure requests route privately within the AWS network. Apply an S3 bucket policy restricting requests to the specific VPC endpoint using the aws:sourceVpce condition.
This configuration satisfies the requirements to bypass the public internet and restrict S3 access strictly to the VPC endpoint rather than just the VPC ID.
3
Establish cross-account trust and authorization paths for both S3 and KMS.
Add decryption permissions to the IAM role in the source account, and update the KMS key policy in the target account to explicitly allow the source IAM role to decrypt. Update the S3 endpoint policy to allow the IAM role to access the target bucket.
For cross-account access, the IAM policy in the source account must authorize the action, and the resource policies (S3 bucket and KMS key policies) in the destination account must explicitly trust and authorize the source IAM principal.

Key Concept

Cross-account S3 and KMS access security via VPC endpoints using Customer Managed Keys.
Rate this question

Topics

Strengthening Identity, Access, and Network Security