Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

An enterprise is designing a new document archiving system. The application tier runs on Amazon EC2 instances in an Application account. The system must store documents in an Amazon S3 bucket located in a central Archive account within the same AWS Organization. The documents must be encrypted at rest using a KMS key. The security team requires that the KMS key be managed in the Archive account. Furthermore, an organization-wide guardrail must prevent any user or role in the Application account from deleting the S3 bucket or scheduling the deletion of the KMS key. Which two actions should the solutions architect recommend to satisfy these requirements? (Select TWO.)

  1. Create a KMS customer managed key in the Archive account and configure its key policy to allow the EC2 instance IAM role in the Application account to perform the kms:GenerateDataKey and kms:DescribeKey actions.Answer
  2. Create a Service Control Policy (SCP) that denies the s3:DeleteBucket and kms:ScheduleKeyDeletion actions, and apply this SCP to the Organizational Unit (OU) containing the Application account.Answer
  3. C
    Configure the S3 bucket default encryption in the Archive account to use the AWS-managed KMS key for Amazon S3 (aws/s3), and modify its key policy to trust the Application account's IAM role.
  4. D
    Create a Service Control Policy (SCP) that explicitly grants s3:PutObject and kms:GenerateDataKey permissions to the Application account, and attach it to the target Organizational Unit (OU).
  5. E
    Modify the S3 bucket policy in the Archive account to allow the S3 service principal (s3.amazonaws.com) to write logs, omitting specific source account or organizational conditions.

Answer

Configure a customer managed key in the Archive account with cross-account access granted via its key policy to the Application account's IAM role, and implement a Service Control Policy (SCP) at the Organizational Unit (OU) level that denies bucket and key deletion.
To satisfy the requirements, the solutions architect must use a Customer Managed Key (CMK) in the Archive account and configure its key policy to explicitly trust the EC2 instance role in the Application account, enabling cross-account encryption. Additionally, the solutions architect must apply a Service Control Policy (SCP) to the OU containing the Application account to enforce compliance by denying bucket deletion and key deletion actions.

Step-by-Step Solution

1
Analyze key ownership requirements.
Identify that an AWS-managed key cannot be used since it does not support cross-account access delegation.
AWS-managed KMS keys do not support custom key policies and are restricted to the account in which they reside.
2
Configure the KMS key policy in the Archive account.
A Customer Managed Key is created, and its key policy is updated to grant permissions to the Application account's EC2 instance IAM role.
This enables the EC2 instances in the Application account to use the key for generating data keys to encrypt uploaded documents.
3
Design and apply the organization guardrail.
A Service Control Policy (SCP) is created that denies the destructive actions (s3:DeleteBucket and kms:ScheduleKeyDeletion) and is applied to the OU of the Application account.
SCPs act as permission guardrails that restrict actions across all principals in member accounts, ensuring compliance.

Key Concept

Cross-account KMS key delegation and Service Control Policies (SCPs) acting as permission guardrails
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic