Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A pharmaceutical corporation is deploying a drug research database in AWS. The architecture consists of two AWS accounts within the same organization: a Data Store Account containing an Amazon S3 bucket with clinical trial data, and an Analytics Account where Amazon EC2 instances analyze the data. The compliance department mandates that all data in the S3 bucket must be encrypted at rest, and the EC2 instances in the Analytics Account must have read-only access to the S3 bucket. Additionally, the encryption keys must be managed by the security team with custom rotation schedules. Which configuration meets these security and compliance requirements?

  1. A
    Use the default AWS-managed KMS key for Amazon S3 (aws/s3) to encrypt the S3 bucket. Update the S3 bucket policy to allow read access from the Analytics Account IAM role. In the Analytics Account, configure the EC2 instance profile IAM policy to allow S3 read permissions and kms:Decrypt permissions on the aws/s3 key.
  2. B
    Create a Customer Managed Key (CMK) in the Data Store Account to encrypt the S3 bucket. Attach a Service Control Policy (SCP) to the Organization Root that allows the Analytics Account IAM role to decrypt using the KMS CMK. Remove S3 bucket policies and key policies, allowing permissions to inherit through the SCP.
  3. Create a Customer Managed Key (CMK) in the Data Store Account to encrypt the S3 bucket. Update the KMS key policy in the Data Store Account to allow the Analytics Account IAM role access to the kms:Decrypt action. In the Data Store Account, configure the S3 bucket policy to allow read access from the Analytics Account IAM role. In the Analytics Account, configure the EC2 instance profile IAM policy to allow S3 read permissions and kms:Decrypt permissions on the CMK.Answer
  4. D
    Create a Customer Managed Key (CMK) in the Data Store Account to encrypt the S3 bucket. In the Data Store Account, configure the S3 bucket policy to allow read access and kms:Decrypt permissions for the Analytics Account IAM role. In the Analytics Account, configure the EC2 instance profile IAM policy to allow S3 read permissions without referencing the KMS CMK.

Answer

Create a Customer Managed Key (CMK) in the Data Store Account to encrypt the S3 bucket. Update the KMS key policy in the Data Store Account to allow the Analytics Account IAM role access to the kms:Decrypt action. In the Data Store Account, configure the S3 bucket policy to allow read access from the Analytics Account IAM role. In the Analytics Account, configure the EC2 instance profile IAM policy to allow S3 read permissions and kms:Decrypt permissions on the CMK.
The correct configuration uses a Customer Managed Key (CMK) to allow policy modifications and custom rotation schedules. For cross-account S3 bucket access with KMS encryption, permissions must be granted on both the resource policies (S3 bucket policy and KMS key policy) in the host account, and in the IAM policy of the accessing principal in the client account.

Step-by-Step Solution

1
Identify the key management and encryption type.
Choose a Customer Managed Key (CMK) rather than an AWS-managed key.
AWS-managed keys do not allow policy modifications, which are required for cross-account access and custom rotation schedules.
2
Configure the key policy in the owning account (Data Store Account).
Modify the CMK key policy to grant the Analytics Account's IAM role the 'kms:Decrypt' action.
Cross-account access to KMS keys requires explicit delegation in the key policy.
3
Configure the S3 bucket policy in the owning account (Data Store Account).
Add an S3 bucket policy allowing 's3:GetObject' from the Analytics Account's IAM role.
Cross-account S3 access requires explicit delegation in the bucket policy.
4
Configure the IAM policy in the client account (Analytics Account).
Attach an IAM policy to the EC2 instance profile allowing 's3:GetObject' on the bucket and 'kms:Decrypt' on the CMK.
The client identity must have local permissions to perform both S3 and KMS actions to successfully access the encrypted object.

Key Concept

Cross-account KMS key delegation and S3 resource sharing under encryption constraints.
Estimated Time:2m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic