Examkin

Question

Difficulty: MediumStrengthening Identity, Access, and Network Security

An enterprise has an existing solution where an application running on Amazon EC2 instances in Account A writes log files to an Amazon S3 bucket in Account B. The S3 bucket is configured with default encryption using the AWS-managed KMS key (aws/s3). The IAM role attached to the EC2 instances has the necessary permissions to write to the S3 bucket, and the bucket policy in Account B allows write access from the IAM role. However, the application's write requests are failing with an Access Denied error. Which solution should the Solutions Architect implement to resolve the write failures and strengthen the security of the cross-account data transfer?

  1. Configure the S3 bucket to use a Customer Managed Key (CMK) in Account B for default encryption. Update the key policy of the CMK in Account B to allow the IAM role in Account A to perform kms:GenerateDataKey and kms:Decrypt actions, and update the IAM role policy in Account A to allow the same kms actions on the CMK in Account B.Answer
  2. B
    Modify the key policy of the default AWS-managed KMS key (aws/s3) in Account B to grant kms:GenerateDataKey and kms:Decrypt permissions to the IAM role in Account A, and verify that the S3 bucket policy allows cross-account access.
  3. C
    Create a Service Control Policy (SCP) at the organizational level that allows cross-account S3 and KMS permissions. Attach the SCP to Account A and Account B to override the default access boundaries for the AWS-managed KMS key (aws/s3).
  4. D
    Configure the S3 bucket default encryption to use a Customer Managed Key (CMK) in Account A. Grant the S3 service principal in Account B permission to use the CMK, and configure the IAM role in Account A to perform kms:GenerateDataKey on the Account A CMK.

Answer

Configure the S3 bucket to use a Customer Managed Key (CMK) in Account B for default encryption, grant the IAM role in Account A the required KMS permissions in both its IAM policy and the CMK key policy in Account B, and ensure the S3 bucket policy allows cross-account write access.
To perform cross-account writes to an S3 bucket that uses KMS encryption, the KMS key must be a Customer Managed Key (CMK) in the destination account (Account B) because AWS-managed keys (like `aws/s3`) cannot be shared across accounts. The key policy of the CMK in Account B must explicitly grant permissions (`kms:GenerateDataKey` and `kms:Decrypt`) to the principal in Account A (the IAM role). Additionally, the IAM role in Account A must also have IAM permissions to use that specific CMK in Account B. Finally, the S3 bucket policy must allow `s3:PutObject` from the Account A IAM role.

Step-by-Step Solution

1
Create a Customer Managed Key (CMK) in the destination account (Account B).
A custom KMS key exists in Account B that can be shared across accounts.
AWS-managed KMS keys (like `aws/s3`) cannot be used for cross-account operations.
2
Update the KMS key policy of the CMK in Account B to trust the IAM role in Account A.
The CMK key policy allows Account A's IAM role to perform `kms:GenerateDataKey` and `kms:Decrypt` actions.
Key policies must explicitly grant cross-account permissions for external IAM principals to use the key.
3
Update the IAM policy of the role in Account A to allow permissions on the CMK in Account B.
The IAM role in Account A is granted authorization to invoke `kms:GenerateDataKey` and `kms:Decrypt` using the Account B CMK.
For cross-account access, permissions must be granted on both the trust side (key policy) and the client side (IAM policy).
4
Modify the default encryption configuration of the S3 bucket in Account B to use the newly created CMK.
Objects uploaded to the bucket will be encrypted with the CMK instead of the AWS-managed key.
This allows the external writer in Account A to use the shared CMK to generate data keys during the upload process.

Key Concept

Cross-Account KMS Key Sharing for Amazon S3 Encryption
Estimated Time:2m 0s
Rate this question

Topics

Strengthening Identity, Access, and Network Security