Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A scientific research organization is designing a data archiving system on AWS to store telemetry data from meteorological sensors. The architecture requires storing files in an Amazon S3 bucket within a shared Logging and Archival account under AWS Organizations. The ingestion workloads run in a separate Ingest account. The organization's security policy requires that all archived data must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS, and the Ingest account must not have permission to decrypt the archived data once it is written. The security team needs to configure the cross-account access securely while adhering to the principle of least privilege. Which combination of configurations will meet these requirements?

  1. A
    Create a Customer Managed Key (CMK) in the Archival account. Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the Ingest account that grants the s3:PutObject and kms:GenerateDataKey permissions. In the Archival account, set the S3 bucket policy and the CMK key policy to trust the Ingest account's root principal, relying on the SCP to authorize the Ingest account's IAM role.
  2. Create a Customer Managed Key (CMK) in the Archival account. In the CMK key policy, grant the Ingest account's IAM role permissions for the kms:GenerateDataKey and kms:DescribeKey actions. In the Ingest account, configure the IAM role policy to allow s3:PutObject on the Archival S3 bucket and kms:GenerateDataKey on the CMK. In the Archival account, configure the S3 bucket policy to allow s3:PutObject from the Ingest account's IAM role.Answer
  3. C
    Configure the target Amazon S3 bucket to use the default AWS-managed KMS key (aws/s3) for encryption. In the Archival account, update the key policy of the AWS-managed KMS key to grant the Ingest account's IAM role permissions for the kms:GenerateDataKey and kms:DescribeKey actions. Grant the Ingest account's IAM role the s3:PutObject permission in both the IAM policy and the S3 bucket policy.
  4. D
    Create a Customer Managed Key (CMK) in the Archival account. In the Archival account, configure the S3 bucket policy to allow s3:PutObject from the Ingest account's IAM role. In the Ingest account, configure the IAM role policy to allow s3:PutObject on the target S3 bucket and kms:GenerateDataKey and kms:Decrypt on the CMK, while keeping the CMK key policy restricted to the Archival account's IAM principals.

Answer

Create a Customer Managed Key (CMK) in the Archival account, grant the Ingest account's IAM role permissions for kms:GenerateDataKey and kms:DescribeKey in the key policy, and configure the Ingest account's IAM policy and the Archival S3 bucket policy to allow the s3:PutObject action.
The correct configuration uses a Customer Managed Key (CMK) in the Archival account, which allows key policy modification. By granting the Ingest account's IAM role the permissions for kms:GenerateDataKey and kms:DescribeKey, the ingestion workload can encrypt data during S3 uploads without having the ability to decrypt the data. This satisfies the least privilege requirement. Additionally, granting s3:PutObject permissions in both the Ingest account's IAM policy and the Archival account's S3 bucket policy completes the cross-account access delegation.

Step-by-Step Solution

1
Select the correct KMS key type for cross-account access.
A Customer Managed Key (CMK) must be used instead of an AWS-managed key, because AWS-managed keys cannot be shared cross-account.
AWS-managed keys (aws/s3) do not support key policy modifications, preventing cross-account delegation.
2
Configure the key policy for the Customer Managed Key (CMK) in the Archival account.
The key policy must explicitly grant the Ingest account's IAM role access to kms:GenerateDataKey and kms:DescribeKey.
For cross-account operations, IAM policies in the source account cannot grant access to the key unless the key policy in the target account delegates that authority to the source account.
3
Ensure the principle of least privilege is followed regarding decryption.
Exclude the kms:Decrypt permission from the Ingest account's IAM policy and the KMS key policy.
The Ingest account only needs to write and encrypt objects, which requires kms:GenerateDataKey and kms:DescribeKey. Excluding kms:Decrypt ensures it cannot read or decrypt the archived data.
4
Configure S3 access permissions.
Add s3:PutObject permissions to the Ingest account's IAM policy and allow the Ingest account's IAM role to perform s3:PutObject in the Archival account's S3 bucket policy.
Cross-account S3 operations require permission in both the caller's IAM policy and the destination bucket's S3 bucket policy.

Key Concept

Cross-account resource access with KMS encryption requires explicit authorization in the KMS key policy, the S3 bucket policy, and the caller's IAM policy, utilizing Customer Managed Keys (CMKs) to support cross-account delegation under the principle of least privilege.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic