Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

AeroQuest Diagnostics is developing a new telemetry analysis platform. Flight telemetries are collected from on-premises sensors and written to an Amazon S3 bucket in a Processing Account (111111111111). An analytics application running on Amazon EKS in an Analytics Account (222222222222) must read these objects to perform machine learning analysis. All objects in the S3 bucket are encrypted at rest using a Customer Managed Key (CMK) in the Processing Account. The solution must follow the principle of least privilege and use direct cross-account access without assuming cross-account IAM roles. Which combination of configurations must the Solutions Architect implement to allow the EKS application to successfully read the encrypted telemetry objects? (Select TWO.)

  1. Configure the S3 bucket policy in the Processing Account (111111111111) to grant s3:GetObject permission to the specific IAM role ARN associated with the EKS service account in the Analytics Account (222222222222).Answer
  2. Configure the key policy of the Customer Managed Key in the Processing Account (111111111111) to grant kms:Decrypt permission to the specific IAM role ARN associated with the EKS service account in the Analytics Account (222222222222).Answer
  3. C
    Configure the EKS service account IAM role to decrypt using the AWS managed KMS key (aws/s3) in the Processing Account (111111111111) for decryption operations.
  4. D
    Attach a Service Control Policy (SCP) to the root of the AWS Organization that grants s3:GetObject and kms:Decrypt permissions to the Analytics Account (222222222222) for resources in the Processing Account (111111111111).
  5. E
    Configure the S3 bucket policy in the Processing Account (111111111111) to allow s3:GetObject for the Analytics Account ID root principal, and configure the EKS service account IAM role to use a session policy with the aws:PrincipalOrgID condition without updating the KMS key policy.

Answer

Configure the S3 bucket policy in the Processing Account to grant s3:GetObject permission to the EKS service account IAM role ARN, and configure the key policy of the Customer Managed Key in the Processing Account to grant kms:Decrypt permission to the EKS service account IAM role ARN.
To allow an IAM role in an external account to retrieve objects encrypted with a Customer Managed Key, two resource-based policies in the source account must be updated: the S3 bucket policy (to grant read access to the objects) and the KMS key policy (to grant decryption rights to the CMK). The combination of these configurations allows direct, secure cross-account reading without the overhead of assuming cross-account roles.

Step-by-Step Solution

1
Identify the encryption mechanism of the source S3 bucket.
The bucket uses a Customer Managed Key (CMK) in the Processing Account (111111111111).
This determines that cross-account access is technically feasible since CMK key policies can be modified, unlike AWS managed keys (aws/s3).
2
Configure cross-account S3 bucket access.
Add an entry to the S3 bucket policy in the Processing Account allowing the specific IAM role ARN of the EKS service account in the Analytics Account to perform s3:GetObject.
For cross-account access, S3 bucket policies must explicitly trust the external principal role.
3
Configure cross-account KMS key access.
Add an entry to the key policy of the Customer Managed Key (CMK) in the Processing Account allowing the specific EKS IAM role ARN to perform kms:Decrypt.
Since the objects are encrypted, S3 needs to decrypt them on behalf of the reading principal, which requires explicit trust in the KMS key policy for cross-account roles.
4
Configure local IAM permissions in the destination account.
Ensure the EKS service account's IAM role in the Analytics Account has local permissions to call s3:GetObject on the bucket and kms:Decrypt on the CMK ARN.
Both local IAM authorization and source resource-based authorization (bucket policy + key policy) are required for cross-account actions.

Key Concept

Cross-account access to encrypted S3 objects requires explicit authorization in the local IAM policy, the remote S3 bucket policy, and the remote KMS Customer Managed Key policy.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic