Examkin

Question

Difficulty: Very hardSecurity and Compliance Control Design

A pharmaceutical company is launching a clinical trials data repository in AWS Account A, which is part of an AWS Organizations organization. An external research organization runs a data ingestion application on Amazon EC2 instances in AWS Account B, which is outside the company's AWS Organizations organization. The application uses the IAM role 'arn:aws:iam::222222222222:role/ResearchAppRole' to write raw patient telemetry files to an Amazon S3 bucket in Account A and read consolidated trial results. All data in the S3 bucket must be encrypted at rest using a customer managed key in AWS Key Management Service (AWS KMS). The company requires that the external role can upload and retrieve files but is strictly prohibited from deleting any files or modifying the bucket configuration. Which two configuration steps must the solutions architect implement in Account A to meet these security and encryption requirements? (Select TWO.)

  1. In Account A, configure the S3 bucket policy to allow the principal 'arn:aws:iam::222222222222:role/ResearchAppRole' to perform 's3:PutObject' and 's3:GetObject' actions.Answer
  2. In Account A, configure the key policy of the KMS customer managed key to allow the principal 'arn:aws:iam::222222222222:role/ResearchAppRole' to perform 'kms:GenerateDataKey' and 'kms:Decrypt' actions.Answer
  3. C
    In Account A, encrypt the S3 bucket using the AWS-managed KMS key for Amazon S3 ('aws/s3'), and configure the bucket policy to allow access to the external role.
  4. D
    In Account A, attach a Service Control Policy (SCP) to the member account that explicitly grants the external role 'arn:aws:iam::222222222222:role/ResearchAppRole' permissions to perform 's3:PutObject' and 's3:GetObject'.
  5. E
    In Account A, configure the S3 bucket policy to trust the root account principal 'arn:aws:iam::222222222222:root' for all S3 actions, and configure the KMS key policy to allow access from all principals within the organization.

Answer

In Account A, configure the S3 bucket policy to allow the principal 'arn:aws:iam::222222222222:role/ResearchAppRole' to perform 's3:PutObject' and 's3:GetObject' actions, and configure the key policy of the KMS customer managed key to allow the same principal to perform 'kms:GenerateDataKey' and 'kms:Decrypt' actions.
To set up secure cross-account read and write access to an S3 bucket encrypted with a customer managed key, the hosting account must configure both the bucket policy and the KMS key policy. The S3 bucket policy must allow the specific IAM role from the external account to perform 's3:PutObject' and 's3:GetObject'. Additionally, because the S3 bucket is encrypted with a KMS customer managed key, the KMS key policy must allow the external IAM role to perform 'kms:GenerateDataKey' (required to write encrypted objects) and 'kms:Decrypt' (required to read encrypted objects).

Step-by-Step Solution

1
Identify key requirements for cross-account S3 and KMS access.
The external principal is an IAM role in Account B, and the S3 bucket and KMS CMK are in Account A.
Understanding the boundary helps determine that cross-account access requires explicit resource-based policies in the hosting account (Account A).
2
Configure the S3 bucket policy in Account A.
The bucket policy must explicitly grant the IAM role 'arn:aws:iam::222222222222:role/ResearchAppRole' permissions for 's3:PutObject' and 's3:GetObject', without granting delete or write bucket configuration privileges.
S3 cross-account access requires the resource owner (Account A) to delegate access to the external identity.
3
Configure the KMS key policy in Account A.
The KMS customer managed key policy must grant the external IAM role permissions for 'kms:GenerateDataKey' and 'kms:Decrypt'.
Since the bucket is encrypted with a customer managed key, the external caller must have permissions to generate data keys for encryption (writes) and decrypt the objects (reads).
4
Verify encryption key constraints.
Confirm that an AWS managed key ('aws/s3') cannot be used since its policy cannot be modified to grant cross-account permissions.
AWS-managed KMS keys are restricted to the local account and cannot be delegated cross-account.

Key Concept

Cross-account resource access delegation using S3 bucket policies and KMS key policies for Customer Managed Keys.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic