Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

An enterprise is designing a secure document processing pipeline. The application runs on Amazon ECS tasks in an Application account. The ECS tasks process documents and must write the output to an Amazon S3 bucket in a separate Compliance account. All documents stored in the S3 bucket must be encrypted at rest using a Customer Managed Key (CMK) that is managed in a centralized Security account. Which combination of configuration steps should the Solutions Architect perform to allow the ECS tasks to successfully write the encrypted objects to the S3 bucket? (Select TWO.)

  1. Configure the KMS key policy in the Security account to allow the ECS task role in the Application account to perform the kms:GenerateDataKey and kms:Decrypt actions.Answer
  2. Configure the S3 bucket policy in the Compliance account to allow the ECS task role in the Application account to perform the s3:PutObject action.Answer
  3. C
    Configure the S3 bucket to use the default AWS-managed KMS key (aws/s3) in the Security account, and grant the ECS task role cross-account access to this key.
  4. D
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing both accounts that allows the kms:GenerateDataKey and s3:PutObject actions to grant the cross-account permissions.
  5. E
    Configure the S3 bucket policy in the Compliance account with a condition statement that permits the write operation only if the request originates from the KMS key ARN in the Security account.

Answer

To enable cross-account S3 uploads encrypted with a centralized KMS key, the KMS key policy in the Security account must grant key access (kms:GenerateDataKey and kms:Decrypt) to the ECS task role, and the S3 bucket policy in the Compliance account must grant write permissions (s3:PutObject) to the ECS task role.
To enable cross-account S3 uploads using KMS encryption, the writing principal needs access to both the target S3 bucket and the encryption key. The S3 bucket policy in the destination Compliance account must allow write access (s3:PutObject) to the ECS task role in the Application account. Concurrently, the KMS key policy of the Customer Managed Key (CMK) in the Security account must allow the same ECS task role to perform key operations (kms:GenerateDataKey and kms:Decrypt) to handle the server-side encryption.

Step-by-Step Solution

1
Evaluate KMS key type limitations.
Ensure a Customer Managed Key (CMK) is used in the Security account instead of an AWS-managed key.
AWS-managed keys do not support policy modification and cannot be shared across AWS accounts.
2
Configure KMS Key Policy in the Security account.
Grant the ECS task role in the Application account the kms:GenerateDataKey and kms:Decrypt actions in the CMK policy.
The ECS task role needs permission to use the KMS key to generate a data key for server-side encryption when writing to the S3 bucket.
3
Configure the S3 Bucket Policy in the Compliance account.
Grant the ECS task role in the Application account the s3:PutObject action in the bucket policy.
Cross-account access to S3 requires the destination bucket's resource policy to explicitly trust the external IAM principal.

Key Concept

Cross-account security controls using IAM, S3 bucket policies, and KMS key policies
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic