Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A retail company is designing a new centralized transaction auditing solution. The application tier runs on Amazon EC2 instances within an Application account (Account A). The application must write transaction logs to an Amazon S3 bucket located in a dedicated Security account (Account B). The logs must be encrypted at rest using AWS KMS. The security team requires that the Security account (Account B) must maintain full ownership and control over all uploaded log files to enforce lifecycle retention policies. Which configuration strategy should the solutions architect implement to meet these requirements?

  1. A
    Create a Service Control Policy (SCP) at the Organization root that grants Account A's IAM role s3:PutObject permissions for Account B's S3 bucket. Configure a customer managed KMS key in Account B, and update its key policy to trust all accounts in the AWS Organization.
  2. B
    Configure the S3 bucket in Account B to use the default AWS-managed KMS key (aws/s3). Update Account B's S3 bucket policy to allow the IAM role in Account A to perform s3:PutObject actions, and configure S3 Object Ownership on the bucket to Bucket Owner Enforced.
  3. Configure a customer managed KMS key in Account B, and update its key policy to allow the IAM role in Account A to perform kms:GenerateDataKey and kms:Decrypt actions. Update Account B's S3 bucket policy to allow the IAM role in Account A to perform s3:PutObject actions, and configure S3 Object Ownership on the bucket to Bucket Owner Enforced.Answer
  4. D
    Configure a customer managed KMS key in Account B, and update its key policy to allow the IAM role in Account A to perform kms:GenerateDataKey and kms:Decrypt actions. Configure the IAM role in Account A with permissions to perform s3:PutObject on the bucket in Account B, and rely on this local IAM policy to grant the cross-account access without modifying Account B's S3 bucket policy.

Answer

Configure a customer managed KMS key in Account B, allow Account A's IAM role to use it, grant s3:PutObject permissions in Account B's bucket policy, and set S3 Object Ownership to Bucket Owner Enforced.
The correct strategy is to use a customer managed KMS key in Account B, configure its key policy to allow Account A's IAM role to generate data keys, allow s3:PutObject in Account B's bucket policy, and enable S3 Object Ownership Bucket Owner Enforced. Using a customer managed KMS key allows cross-account policy updates, which is not possible with AWS-managed keys. Specifying Bucket Owner Enforced disables S3 ACLs and automatically transfers ownership of all uploaded objects to Account B, satisfying the ownership and control requirement.

Step-by-Step Solution

1
Identify key sharing limits.
Determine that the default AWS-managed KMS key (aws/s3) cannot be shared across AWS accounts because its policy cannot be modified. A customer managed KMS key must be used in the destination account.
Ensures that Account A's IAM role has permission to generate data keys from the key in Account B.
2
Configure the KMS key policy.
Allow Account A's IAM role to perform kms:GenerateDataKey and kms:Decrypt operations on the customer managed key in Account B.
Allows the application to encrypt logs using the key managed by the Security account.
3
Configure cross-account S3 bucket policy.
Create a bucket policy in Account B that explicitly allows Account A's IAM role to perform s3:PutObject.
Grants the necessary write permissions across accounts, which local IAM policies in the source account cannot do on their own.
4
Enforce bucket ownership.
Set the S3 Object Ownership configuration to Bucket Owner Enforced.
Disables ACLs and automatically transfers ownership of all uploaded log files to Account B, meeting the security and compliance requirements.

Key Concept

Cross-account security and compliance control design using KMS key policies, S3 bucket policies, and S3 Object Ownership settings.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic