Examkin

Question

Difficulty: MediumEnhancing Data Protection and Compliance

An online education SaaS provider manages its multi-account environment using AWS Organizations. Student record archives containing personally identifiable information (PII) are stored in an Amazon S3 bucket within each regional business unit's AWS account. Currently, these S3 buckets are encrypted using the default AWS managed key (aws/s3). The compliance team in a centralized Security account needs to audit these records by running read-only analysis tools that access the buckets directly. The solutions architect must enhance the data protection strategy to enforce encryption using keys that support automatic rotation, while allowing the compliance team's read-only tools to decrypt and audit the data. Which combination of actions will meet these requirements? (Select TWO.)

  1. Create a customer managed KMS key in each business unit's AWS account with automatic key rotation enabled. Update the KMS key policy in each account to grant the centralized Security account's audit IAM role the kms:Decrypt permission.Answer
  2. Update the S3 bucket policy in each business unit's AWS account to grant the centralized Security account's audit IAM role the s3:GetObject permission. Configure the S3 default bucket encryption to use the newly created customer managed KMS key.Answer
  3. C
    Configure the existing S3 buckets to continue using the AWS managed key (aws/s3) for encryption, and add cross-account trust permissions for the Security account's audit role inside the aws/s3 key policy.
  4. D
    Apply a Service Control Policy (SC) at the AWS Organizations Root level that grants the centralized Security account's audit IAM role read permissions to all S3 buckets and KMS keys in the member accounts.
  5. E
    Enable AWS CloudTrail in each business unit account to log S3 data events, directing the trails to a centralized S3 bucket in the Security account, while relying on the default S3 bucket policy of the centralized bucket without adding explicit cross-account permissions for CloudTrail.

Answer

To enhance data protection and allow cross-account auditing, create a customer managed KMS key in each business unit account with automatic key rotation enabled, grant the Security account's audit role decryption permissions in the key policy, and update the S3 bucket policies in the business unit accounts to grant object read access to the audit role while configuring default encryption to use the new customer managed key.
For cross-account access to S3 objects encrypted with SSE-KMS, permissions must be granted on both the S3 bucket (via bucket policy) and the KMS key (via key policy). Using a customer managed KMS key is necessary because AWS managed keys (aws/s3) cannot be shared across accounts. Enabling automatic rotation on the customer managed keys fulfills the compliance requirement, and the key policy must grant decrypt permissions to the audit role.

Step-by-Step Solution

1
Evaluate the current encryption configuration and recognize key sharing constraints.
Confirm that the default AWS managed key (aws/s3) cannot be shared across accounts due to the inability to modify its key policy.
This establishes the requirement to provision customer managed KMS keys.
2
Configure encryption keys with compliance and access permissions.
Create customer managed KMS keys in the business unit accounts, enable automatic key rotation, and update their key policies to allow the Security account's audit IAM role to decrypt.
This satisfies the automatic rotation requirement and delegates cross-account decryption rights.
3
Configure the S3 bucket access permissions.
Configure default bucket encryption to use the new customer managed key and update the bucket policy to grant the Security account's audit IAM role s3:GetObject permissions.
This completes the permission chain required for cross-account S3 object retrieval.

Key Concept

Cross-account access to S3 objects encrypted with customer managed KMS keys
Estimated Time:2m 0s
Rate this question

Topics

Enhancing Data Protection and Compliance