A company is strengthening the security posture of an existing data archiving application. The application runs on Amazon EC2 instances within a private subnet in Account A. The application must write archive files to an Amazon S3 bucket located in Account B. The S3 bucket is encrypted using a Customer Managed Key (CMK) in Account B. The security team requires that all network traffic to Amazon S3 and AWS KMS remains within the AWS private network, and that the application's IAM role in Account A is the only entity allowed to write to the S3 bucket and use the KMS key. Which combination of actions must a Solutions Architect implement to meet these requirements? (Select TWO.)
- In Account A's VPC, create a Gateway VPC endpoint for Amazon S3 and an Interface VPC endpoint for AWS KMS. Configure the VPC route tables in Account A to route S3 traffic through the Gateway VPC endpoint.Answer
- Configure the S3 bucket policy in Account B to allow the s3:PutObject action from the application's IAM role ARN in Account A. Configure the KMS key policy in Account B to allow kms:GenerateDataKey and kms:Decrypt actions for the application's IAM role ARN.Answer
- CAttach a Service Control Policy (SCP) to the Organizational Unit containing Account A that grants the required S3 and KMS permissions to the application's IAM role, allowing the removal of the local IAM policy in Account A.
- DConfigure the S3 bucket in Account B to use the default AWS-managed KMS key (aws/s3) and update the key policy to delegate cross-account access permissions to Account A.
- EDeploy a Transit Gateway to route the S3 and KMS traffic to Account B's VPC, using Account B's Gateway VPC endpoints, and associate Account B's Route 53 Private Hosted Zone for S3 with Account A's VPC.
Answer
To establish secure, private cross-account connectivity, the Solutions Architect must deploy a Gateway VPC endpoint for S3 and an Interface VPC endpoint for KMS in Account A. In Account B, the S3 bucket policy and the Customer Managed Key (CMK) policy must be configured to grant access to the application's cross-account IAM role.
Establishing a secure cross-account connection to a KMS-encrypted S3 bucket over private networks requires configuring endpoints for both services in the client VPC. S3 uses a Gateway VPC endpoint, while KMS requires an Interface VPC endpoint because cryptographic data key generation and decryption calls are made directly to KMS endpoints. Additionally, because the resource resides in a different account, the S3 bucket policy and the KMS customer managed key policy in the destination account must explicitly permit actions from the client IAM role ARN.
Step-by-Step Solution
Key Concept
Cross-account access to KMS-encrypted S3 buckets over private endpoints