Examkin

Question

Difficulty: HardStrengthening Identity, Access, and Network Security

An enterprise is auditing its AWS environment to strengthen network and identity security for a data processing application. The application runs on Amazon EC2 instances in a private subnet within VPC A (Account A) and reads and writes sensitive objects in an Amazon S3 bucket located in Account B. VPC A is connected to a shared services VPC in Account B via an AWS Transit Gateway. Currently, the EC2 instances access the S3 bucket via an S3 Gateway Endpoint in VPC A. The S3 bucket is encrypted using the default AWS managed key (aws/s3). The current S3 bucket policy allows read and write access to the IAM role attached to the EC2 instances. The security architect must implement a solution to restrict S3 bucket access so that it is only reachable from VPC A, prevent the application from accessing any S3 buckets other than the designated one in Account B, and enforce encryption with a key that supports cross-account access. What is the most secure and operationally efficient configuration to meet these requirements?

  1. Configure a Customer Managed Key (CMK) in Account B for S3 bucket encryption, and update its key policy to allow the application's IAM role in Account A to perform kms:Decrypt and kms:GenerateDataKey operations. Update the VPC A S3 Gateway Endpoint policy to permit s3:GetObject and s3:PutObject only for the Account B bucket. In Account B, configure the S3 bucket policy to allow access from the IAM role in Account A, with a condition restricting access to the Gateway Endpoint ID (aws:sourceVpce) of VPC A.Answer
  2. B
    Keep the default S3 encryption with the AWS managed key (aws/s3). Update the IAM policy of the application's IAM role in Account A to permit kms:Decrypt and kms:GenerateDataKey on the S3 managed key. Update the VPC A S3 Gateway Endpoint policy to limit access to the Account B bucket. In Account B, configure the S3 bucket policy to allow access from the IAM role in Account A, restricting access to the source IP range of VPC A using the aws:SourceIp condition.
  3. C
    Configure a Customer Managed Key (CMK) in Account B for S3 bucket encryption, granting key access to Account A's root user. Create an S3 Gateway Endpoint in the Shared Services VPC (Account B). Update the Transit Gateway route tables to route all S3-destined traffic from VPC A to Account B's Gateway Endpoint. Configure the S3 bucket policy to allow access from Account A's IAM role, restricting access to VPC A's VPC ID using the aws:sourceVpc condition.
  4. D
    Configure a Customer Managed Key (CMK) in Account B for S3 bucket encryption, granting key access to Account A's IAM role. In VPC A, delete the Gateway Endpoint and create an S3 Interface Endpoint. Attach an endpoint policy to the Interface Endpoint that allows access to all S3 resources. Create a Route 53 Private Hosted Zone (PHZ) in Account B for s3.amazonaws.com, associate it with VPC A, and configure the S3 bucket policy in Account B to restrict access to the Interface Endpoint's private IP addresses.

Answer

Configure a Customer Managed Key (CMK) in Account B, updating its key policy for cross-account access, update the VPC A S3 Gateway Endpoint policy to permit traffic only to the Account B bucket, and restrict the S3 bucket policy to the Gateway Endpoint ID (aws:sourceVpce).
The correct solution involves configuring a Customer Managed Key (CMK) in Account B, updating its key policy to allow the IAM role in Account A access to perform cryptographic operations, restricting the Gateway Endpoint policy in VPC A to target only the Account B bucket, and configuring the S3 bucket policy in Account B to restrict access to the specific VPC A S3 Gateway Endpoint ID.

Step-by-Step Solution

1
Transition S3 encryption from the default AWS managed key to a Customer Managed Key (CMK) in Account B.
Enables the ability to modify the KMS key policy to permit cross-account IAM role access.
AWS managed keys do not support policy modification and cannot be accessed across different AWS accounts.
2
Modify the S3 Gateway Endpoint policy in VPC A to restrict allowed resources to the specific bucket in Account B.
Prevents unauthorized data exfiltration or access to other S3 buckets from the EC2 instances in VPC A.
Endpoint policies control the destinations reachable through the VPC endpoint.
3
Update the S3 bucket policy in Account B to allow access from VPC A's IAM role under the condition that the request passes through the VPC A S3 Gateway Endpoint.
Ensures all data access is restricted to the specific VPC A Gateway Endpoint via the aws:sourceVpce condition.
This locks down S3 network access to the designated private network path.

Key Concept

Cross-account S3 access, custom KMS key delegation, and VPC endpoint policy containment.
Rate this question

Topics

Strengthening Identity, Access, and Network Security