Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A global e-commerce company is designing a new microservice that runs on Amazon EC2 instances in an Auto Scaling Group in the Application Account (account ID 111122223333). The microservice needs to upload transaction records to a centralized Amazon S3 bucket located in a separate Compliance Account (account ID 444455556666). The transaction records contain sensitive customer data and must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS that is managed in the Compliance Account. The solutions architect must design a secure, cross-account access solution that adheres to the principle of least privilege. Which combination of actions will allow the microservice to securely write the encrypted transaction records to the S3 bucket? (Select TWO.)

  1. In the Compliance Account, update the KMS CMK key policy to grant the EC2 instance role in the Application Account permissions to perform the kms:GenerateDataKey and kms:Decrypt operations.Answer
  2. In the Application Account, attach an IAM policy to the EC2 instance role that grants the s3:PutObject permission on the destination S3 bucket, and the kms:GenerateDataKey permission on the KMS CMK in the Compliance Account.Answer
  3. C
    In the Compliance Account, configure the S3 bucket to use the AWS-managed KMS key (aws/s3) for encryption, and update its key policy to grant cross-account permissions to the EC2 instance role.
  4. D
    In the Compliance Account, configure the S3 bucket policy to grant s3:PutObject permission to the EC2 instance role, and omit the IAM policy on the EC2 instance role because resource-based policies alone are sufficient to authorize cross-account access.
  5. E
    In the organization management account, attach a Service Control Policy (SCP) to the Organizational Unit (OU) of the Application Account that explicitly grants the EC2 instance role access to the S3 bucket and the KMS CMK in the Compliance Account.

Answer

To securely write encrypted transaction records across accounts, you must update the KMS key policy in the Compliance Account to grant the EC2 instance role permissions for key generation and decryption, and attach an IAM policy to the EC2 instance role in the Application Account that permits writing to the bucket and using the KMS CMK.
For cross-account access, access must be allowed by both the IAM policy attached to the source principal (the EC2 instance role in the Application Account) and the resource-based policy (the S3 bucket policy and the KMS key policy in the Compliance Account). The EC2 instance role needs permissions to write to the destination bucket and use the KMS CMK to generate data keys for encryption. Correspondingly, the key policy in the Compliance Account must grant access to the external role.

Step-by-Step Solution

1
Configure permissions on the source IAM role in the Application Account.
The EC2 instance profile's IAM role is updated with a policy allowing s3:PutObject on the bucket arn:aws:s3:::compliance-bucket and kms:GenerateDataKey on the KMS CMK in the Compliance Account.
Source principals require explicit local IAM permissions to access resources in another account.
2
Configure the resource-based policy on the destination KMS CMK in the Compliance Account.
The KMS key policy is updated to include a statement allowing the EC2 instance role ARN from the Application Account to perform kms:GenerateDataKey and kms:Decrypt.
Since the KMS key is owned by the Compliance Account, the key policy must trust and authorize the external IAM role.
3
Configure the S3 bucket policy in the Compliance Account.
The S3 bucket policy is updated to grant s3:PutObject permission to the EC2 instance role ARN from the Application Account.
Cross-account S3 operations require both the bucket policy and the caller's IAM policy to allow the action.

Key Concept

Cross-Account Resource Access with KMS and S3
Estimated Time:2m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic