Examkin

Question

Difficulty: MediumStrengthening Identity, Access, and Network Security

An enterprise wants to improve the security posture of an existing application running on Amazon EC2 instances in a private subnet of VPC A (Account A). The application needs to securely upload objects to an Amazon S3 bucket located in Account B. The objects in the S3 bucket must be encrypted at rest, and the encryption key must be managed securely with cross-account access. The network path to the S3 bucket must not traverse the public internet. Which two actions should the Solutions Architect take to meet these security requirements?

  1. Create a Customer Managed Key (CMK) in Account B, and configure its key policy to grant the EC2 IAM role in Account A permissions to perform KMS cryptographic operations.Answer
  2. Create an Amazon S3 Interface VPC Endpoint in VPC A, and update the S3 bucket policy in Account B to restrict access to requests originating from that specific VPC endpoint ID.Answer
  3. C
    Configure default S3 bucket encryption in Account B using the AWS-managed KMS key for S3, and update its key policy to allow cross-account access for the IAM role in Account A.
  4. D
    Attach a Service Control Policy (SCP) to the Organizational Unit containing Account B to explicitly allow the EC2 IAM role in Account A to access the bucket, removing the need for a local IAM policy.
  5. E
    Create a Route 53 Private Hosted Zone in Account B for the S3 service, associate it with the VPC in Account A, and configure Route 53 Resolver rules to route S3 traffic.

Answer

To meet the requirements, the Solutions Architect must create a Customer Managed Key in Account B and grant cross-account permissions to the EC2 IAM role in Account A, and create an Amazon S3 Interface VPC Endpoint in VPC A while restricting Account B's bucket policy to requests originating from that VPC endpoint.
Creating a Customer Managed Key in Account B allows you to modify the key policy to permit the IAM role from Account A to perform cryptographic operations. Combining this with an Amazon S3 Interface VPC Endpoint in VPC A and restricting the bucket policy in Account B to that endpoint ID ensures that traffic remains private and only flows through the designated endpoint.

Step-by-Step Solution

1
Select the correct encryption key type.
Use a Customer Managed Key (CMK) in Account B instead of an AWS-managed key.
AWS-managed keys (like aws/s3) cannot have their policies modified and therefore do not support cross-account access.
2
Configure the key policy for cross-account access.
Add a statement to the CMK key policy in Account B that allows the EC2 IAM role in Account A to use the key.
Cross-account KMS access requires permissions on both the KMS key policy (key owner) and the IAM policy (user owner).
3
Configure private network connectivity to S3.
Provision an Amazon S3 Interface VPC Endpoint in VPC A.
This establishes a private network path via AWS PrivateLink so that traffic does not traverse the public internet.
4
Enforce the private path in the bucket policy.
Modify the S3 bucket policy in Account B to deny requests that do not specify the correct VPC endpoint ID in the condition block.
This guarantees that all write operations must traverse the interface endpoint, preventing access from unauthorized public or private networks.

Key Concept

Cross-account KMS and S3 private connectivity using VPC endpoints.
Estimated Time:2m 0s
Rate this question

Topics

Strengthening Identity, Access, and Network Security