Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A logistics enterprise is building a new supply-chain tracking platform. The architecture stores sensitive transaction logs in an Amazon S3 bucket within a dedicated Storage Account. An analytics application running on Amazon ECS tasks in a separate Processing Account needs to read and write objects in this S3 bucket. All data stored in the S3 bucket must be encrypted at rest using an AWS KMS key. The design must adhere to the principle of least privilege while enabling secure cross-account access. Which design strategy meets these requirements?

  1. Encrypt the S3 bucket with a Customer Managed Key (CMK) in the Storage Account. Configure the CMK key policy to allow the Processing Account's ECS task role kms:Decrypt and kms:GenerateDataKey permissions. Update the S3 bucket policy to allow the ECS task role s3:GetObject and s3:PutObject permissions. Attach an IAM policy to the ECS task role in the Processing Account that allows S3 and KMS actions on these resources.Answer
  2. B
    Encrypt the S3 bucket using the default AWS managed key (aws/s3). Configure the S3 bucket policy to allow the Processing Account's ECS task role s3:GetObject and s3:PutObject permissions. Attach an IAM policy to the ECS task role in the Processing Account that allows S3 and KMS actions on these resources.
  3. C
    Encrypt the S3 bucket with a Customer Managed Key (CMK) in the Storage Account. Apply a Service Control Policy (SCP) at the Organizational Unit level that grants the Processing Account's ECS task role access to the S3 bucket and the CMK. Avoid modifying the CMK key policy or the S3 bucket policy in the Storage Account.
  4. D
    Encrypt the S3 bucket with a Customer Managed Key (CMK) in the Storage Account. Configure the CMK key policy to allow the Processing Account's ECS task role kms:Decrypt and kms:GenerateDataKey permissions. Attach an IAM policy to the ECS task role in the Processing Account that allows S3 and KMS actions on the storage resources, omitting the S3 bucket policy to rely on IAM authority.

Answer

Encrypt the S3 bucket with a Customer Managed Key (CMK) in the Storage Account. Configure the CMK key policy to allow the Processing Account's ECS task role kms:Decrypt and kms:GenerateDataKey permissions. Update the S3 bucket policy to allow the ECS task role s3:GetObject and s3:PutObject permissions. Attach an IAM policy to the ECS task role in the Processing Account that allows S3 and KMS actions on these resources.
The correct strategy uses a Customer Managed Key (CMK) because its key policy can be configured to delegate permissions to an external account. The security design correctly requires permissions on the S3 bucket policy (granting write/read), the KMS key policy (granting decrypt/generate data key), and the client-side IAM policy (granting the ECS task role access to the resources).

Step-by-Step Solution

1
Determine the type of KMS key to use.
Identify that a Customer Managed Key (CMK) is required.
AWS-managed keys (aws/s3) have read-only key policies that cannot be modified to allow cross-account access.
2
Establish trust on the S3 bucket.
Add an S3 bucket policy in the Storage Account allowing the ECS task role read and write access.
For cross-account access, the S3 bucket owner must explicitly grant access to the external principal.
3
Establish trust on the KMS key.
Add a statement in the CMK key policy in the Storage Account allowing the ECS task role kms:Decrypt and kms:GenerateDataKey.
The key policy must explicitly authorize the external role to perform cryptographic operations with the CMK.
4
Configure the local IAM permissions.
Attach an IAM policy to the ECS task role in the Processing Account allowing S3 operations on the bucket and KMS operations on the CMK.
The accessing account must grant its own principal permission to access the external resources.

Key Concept

Cross-account access to encrypted S3 resources requires coordination of the S3 bucket policy, the KMS key policy (which must be a Customer Managed Key), and the IAM policy of the calling principal.
Estimated Time:2m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic