Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A SaaS company is designing a secure document archiving solution in AWS. The architecture requires applications running on Amazon EC2 instances in a Production Account (Account A) to write PDF reports directly to an Amazon S3 bucket located in a dedicated Compliance Archive Account (Account B). The reports contain sensitive data and must be encrypted at rest. The compliance team mandates that the encryption keys must be managed centrally in the Compliance Archive Account (Account B), and cross-account access to the encryption key must be strictly limited to the specific EC2 instance role in the Production Account. Which configuration strategy should the solutions architect implement to meet these requirements?

  1. A
    In Account B, configure the S3 bucket to use the default AWS-managed KMS key (aws/s3). In Account A, attach an IAM policy to the EC2 instance role that grants decryption and encryption permissions to the AWS-managed KMS key in Account B.
  2. In Account B, create a customer managed KMS key and update its key policy to allow the EC2 instance IAM role in Account A to perform KMS cryptographic operations. In Account B, configure the S3 bucket to use this customer managed KMS key as the default encryption key.Answer
  3. C
    In Account B, create a customer managed KMS key. In AWS Organizations, apply a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account A that allows the kms:GenerateDataKey and kms:Decrypt actions on the KMS key in Account B, bypassing the need for local IAM and KMS key policy configurations.
  4. D
    In Account B, create a customer managed KMS key. Configure the S3 bucket policy in Account B to grant the EC2 instance IAM role in Account A permissions to perform KMS cryptographic operations on the KMS key.

Answer

In Account B, create a customer managed KMS key and update its key policy to allow the EC2 instance IAM role in Account A to perform KMS cryptographic operations. In Account B, configure the S3 bucket to use this customer managed KMS key as the default encryption key.
The correct answer correctly specifies creating a customer managed key in the archive account (Account B) and configuring the key policy to delegate access to the EC2 instance IAM role in the production account (Account A). This is required because AWS-managed keys cannot be shared across accounts, and KMS access controls must be defined directly in the key policy.

Step-by-Step Solution

1
Select the correct key type for cross-account operations.
Determine that an AWS-managed key cannot be used since its policy cannot be modified to grant cross-account access. A customer managed key is selected.
AWS-managed keys (such as aws/s3) do not allow changes to their key policies and cannot be shared across accounts.
2
Configure the key policy in the target account.
In Account B (Compliance Archive Account), configure the customer managed key policy to allow the EC2 instance role ARN from Account A (Production Account) to perform actions such as kms:GenerateDataKey and kms:Decrypt.
Cross-account access to KMS requires the key policy to explicitly trust the external IAM entity.
3
Apply IAM permissions in the source account.
Configure the EC2 instance profile IAM role in Account A to permit kms:GenerateDataKey and kms:Decrypt on the customer managed key in Account B.
For cross-account access, permissions must be granted both in the key policy (delegating access to the external account or role) and in the local IAM policy (authorizing the role to call KMS).

Key Concept

Cross-account KMS key sharing and policy requirements
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic