Examkin

Question

Difficulty: Very hardEnhancing Data Protection and Compliance

An enterprise has an existing AWS Organizations structure where member accounts upload sensitive daily transaction logs to a centralized Amazon S3 bucket in a dedicated Logging account. Currently, the bucket uses Amazon S3 managed encryption keys (SSE-S3). To comply with a new security standard, a solutions architect must improve the data protection controls. The requirements are:

* All logs stored in the bucket must be encrypted using an AWS KMS customer managed key (CMK) managed by the Logging account.
* The member accounts must be able to write to the bucket and encrypt the objects using this KMS key.
* The Logging account must have full ownership and administrative control over all uploaded objects.
* All unencrypted uploads and uploads not using the specified KMS key must be blocked.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Configure S3 Object Ownership to 'Bucket owner enforced' on the destination bucket, and add a bucket policy statement that denies s3:PutObject uploads if the s3:x-amz-server-side-encryption header is not set to aws:kms or if the s3:x-amz-server-side-encryption-aws-kms-key-id header does not specify the customer managed key's ARN.Answer
  2. Configure the customer managed key's policy in the Logging account to allow the member accounts' IAM roles to perform kms:GenerateDataKey and kms:Decrypt operations.Answer
  3. C
    Deploy a Service Control Policy (SCP) at the root level of the organization that explicitly grants member accounts permission to perform kms:GenerateDataKey and kms:Decrypt on the Logging account's KMS customer managed key.
  4. D
    Configure the S3 bucket's default encryption to use the AWS-managed KMS key for Amazon S3 (aws/s3), and modify its policy to grant kms:GenerateDataKey and kms:Decrypt permissions to the member accounts' IAM roles.
  5. E
    Add a statement to the S3 bucket policy in the Logging account that defines the Principal element directly as the AWS Organization ID (o-xxxxxxxxx), allowing member accounts to upload objects using default encryption without requiring explicit KMS key policy changes.

Answer

Configure S3 Object Ownership to 'Bucket owner enforced' on the destination bucket, and add a bucket policy statement that denies uploads if the encryption headers do not specify server-side encryption with AWS KMS using the customer managed key's ARN. In addition, configure the customer managed key's policy in the Logging account to allow the member accounts' IAM roles to perform kms:GenerateDataKey and kms:Decrypt operations.
To allow member accounts to write to a centralized bucket in the Logging account and encrypt objects using a customer managed key (CMK), the key policy of the CMK in the Logging account must explicitly delegate permission to the external member accounts (or roles within them) to perform kms:GenerateDataKey and kms:Decrypt. Additionally, to enforce bucket owner ownership of all objects uploaded from external accounts, the S3 Object Ownership setting must be configured to 'Bucket owner enforced' (which disables ACLs and automatically transfers ownership of uploaded objects to the bucket owner). Finally, the S3 bucket policy must contain a deny statement that blocks any upload (s3:PutObject) that does not use aws:kms encryption or does not specify the ARN of the customer managed key.

Step-by-Step Solution

1
Ensure the Logging account maintains full ownership of all uploaded objects.
Configure S3 Object Ownership with the 'Bucket owner enforced' setting to disable ACLs.
This guarantees that any object uploaded cross-account is automatically owned by the Logging account, preventing permission fragmentation.
2
Configure cross-account key permissions on the customer managed key (CMK).
Modify the KMS CMK key policy in the Logging account to allow the member accounts' IAM principals to perform kms:GenerateDataKey and kms:Decrypt.
KMS keys require explicit delegation in their key policy for cross-account access, as IAM policies in the caller accounts cannot grant access to keys in external accounts.
3
Enforce compliant encryption at the bucket level.
Add a deny statement in the S3 bucket policy for s3:PutObject requests that lack the s3:x-amz-server-side-encryption condition matching 'aws:kms' or the s3:x-amz-server-side-encryption-aws-kms-key-id condition matching the specific CMK ARN.
This blocks non-compliant uploads (e.g., unencrypted, SSE-S3, or using an incorrect key).

Key Concept

Cross-account S3 security, KMS key policies, S3 Object Ownership, and encryption compliance enforcement.
Estimated Time:3m 0s
Rate this question

Topics

Enhancing Data Protection and Compliance