Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

A media conglomerate is designing a security and compliance architecture for a new video processing pipeline. The pipeline involves a transcoding application running on Amazon ECS tasks in the Media Processing account (Account 111122223333). The processed video files must be written directly to a centralized Amazon S3 bucket located in the Compliance Archive account (Account 444455556666). The S3 bucket is encrypted using a Customer Managed Key (CMK) in the Compliance Archive account. The regulatory team requires that all uploaded videos are owned exclusively by the Compliance Archive account, and the ECS tasks must be able to encrypt the objects during upload. Which combination of configurations will allow the ECS tasks to successfully write the files to the centralized S3 bucket? (Select TWO.)

  1. Enable S3 Object Ownership with the Bucket Owner Enforced setting on the S3 bucket in the Compliance Archive account, and configure the S3 bucket policy to grant s3:PutObject permissions to the ECS task role in the Media Processing account.Answer
  2. Configure the KMS key policy in the Compliance Archive account to grant kms:GenerateDataKey and kms:Decrypt permissions to the ECS task role in the Media Processing account, and configure the ECS task IAM policy in the Media Processing account to grant the same KMS permissions.Answer
  3. C
    Configure the S3 bucket in the Compliance Archive account to use the AWS-managed key aws/s3 for encryption, and configure the ECS task role in the Media Processing account with IAM permissions to access this AWS-managed key.
  4. D
    Configure the S3 bucket policy in the Compliance Archive account to grant s3:PutObject permissions to the Media Processing account, and configure the S3 bucket to use the default aws/s3 AWS-managed key to allow cross-account encryption.
  5. E
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the Media Processing account that explicitly grants s3:PutObject and kms:GenerateDataKey permissions to the ECS task execution role.

Answer

Configure Bucket Owner Enforced ownership on the destination S3 bucket along with cross-account s3:PutObject permissions on the bucket policy, and configure both the source IAM policy and the destination KMS key policy to permit kms:GenerateDataKey and kms:Decrypt on the Customer Managed Key for the ECS task role.
To achieve cross-account uploads with bucket-owner ownership and CMK encryption, the destination bucket must disable ACLs using S3 Object Ownership (Bucket Owner Enforced), and its policy must trust the source ECS task role. Additionally, the destination KMS key policy and the source IAM policy must both grant kms:GenerateDataKey and kms:Decrypt permissions to the ECS task role.

Step-by-Step Solution

1
Address object ownership in the destination bucket.
By enabling S3 Object Ownership with the Bucket Owner Enforced setting, access control lists (ACLs) are disabled, and all objects uploaded to the bucket by external accounts automatically become owned and controlled by the bucket owner (Compliance Archive account).
This satisfies the requirement that all uploaded videos must be owned exclusively by the Compliance Archive account.
2
Set up the destination S3 bucket policy.
The bucket policy must explicitly grant s3:PutObject permissions to the ECS task role principal from the Media Processing account.
For cross-account access, trust must be established in the resource-based policy of the receiving account.
3
Configure encryption permissions on the Customer Managed Key.
Modify the KMS key policy in the Compliance Archive account to allow the ECS task role in the Media Processing account to call kms:GenerateDataKey and kms:Decrypt.
AWS S3 requires kms:GenerateDataKey to write encrypted objects and kms:Decrypt to verify the write (especially during multipart uploads) when using a Customer Managed Key.
4
Grant outbound KMS permissions to the ECS task role.
Add an IAM policy to the ECS task role in the Media Processing account allowing kms:GenerateDataKey and kms:Decrypt on the CMK ARN.
For cross-account access to KMS, both the key policy (resource-based policy) and the IAM policy (identity-based policy) must explicitly permit the actions.

Key Concept

Cross-account access and encryption control design using S3 Bucket Policies, S3 Object Ownership settings, and Customer Managed KMS Keys.
Estimated Time:2m 30s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic