Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

A global logistics corporation uses AWS Organizations with multiple member accounts. Security analysts must authenticate using the company's on-premises SAML 2.0 Identity Provider (IdP) to assume an IAM role named SecurityAuditorRole in a centralized Identity account (111122223333111122223333). From this role, the analysts run query analyses using Amazon Athena on regulatory compliance logs stored in an Amazon S3 bucket within a separate Security Logging account (444455556666444455556666). The S3 bucket requires all objects to be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). Which combination of configurations must a solutions architect implement to securely grant the security analysts the access required to retrieve and decrypt the logs?

  1. A
    In the Identity account, configure the trust policy of SecurityAuditorRole to allow the sts:AssumeRole action from the SAML provider. Attach an IAM policy to SecurityAuditorRole that allows s3:GetObject on the S3 bucket and kms:Decrypt on a Customer Managed Key (CMK) in the Security Logging account. In the Security Logging account, configure the S3 bucket policy to allow s3:GetObject for the SecurityAuditorRole ARN, and configure the CMK's key policy to allow kms:Decrypt for the SecurityAuditorRole ARN.
  2. B
    In the Identity account, configure the trust policy of SecurityAuditorRole to allow the sts:AssumeRoleWithSAML action from the SAML provider. Attach an IAM policy to SecurityAuditorRole that allows s3:GetObject on the S3 bucket and kms:Decrypt on the AWS managed key (aws/s3) in the Security Logging account. In the Security Logging account, configure the S3 bucket policy to allow s3:GetObject for the SecurityAuditorRole ARN.
  3. In the Identity account, configure the trust policy of SecurityAuditorRole to allow the sts:AssumeRoleWithSAML action from the SAML provider. Attach an IAM policy to SecurityAuditorRole that allows s3:GetObject on the S3 bucket and kms:Decrypt on a Customer Managed Key (CMK) in the Security Logging account. In the Security Logging account, configure the S3 bucket policy to allow s3:GetObject for the SecurityAuditorRole ARN, and configure the CMK's key policy to allow kms:Decrypt for the SecurityAuditorRole ARN.Answer
  4. D
    In the Identity account, configure the trust policy of SecurityAuditorRole to allow the sts:AssumeRoleWithSAML action from the SAML provider. In the AWS Organizations management account, attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing both accounts that explicitly permits the SecurityAuditorRole ARN to perform s3:GetObject on the S3 bucket and kms:Decrypt on the KMS key in the Security Logging account.

Answer

In the Identity account, configure the trust policy of SecurityAuditorRole to allow the sts:AssumeRoleWithSAML action from the SAML provider. Attach an IAM policy to SecurityAuditorRole that allows s3:GetObject on the S3 bucket and kms:Decrypt on a Customer Managed Key (CMK) in the Security Logging account. In the Security Logging account, configure the S3 bucket policy to allow s3:GetObject for the SecurityAuditorRole ARN, and configure the CMK's key policy to allow kms:Decrypt for the SecurityAuditorRole ARN.
The correct configuration uses the sts:AssumeRoleWithSAML action in the IAM role's trust policy to support federation from the SAML IdP. It encrypts the target S3 bucket with a Customer Managed Key (CMK) to allow modification of its key policy. It then configures cross-account access by granting outbound permissions in the source IAM role policy and inbound permissions in both the target S3 bucket policy and the target KMS key policy.

Step-by-Step Solution

1
Configure SAML 2.0 federation trust policy for the IAM role.
The SecurityAuditorRole trust policy is set to allow the sts:AssumeRoleWithSAML action for the SAML identity provider in the Identity account (111122223333111122223333).
SAML federation requires the sts:AssumeRoleWithSAML API action to exchange SAML assertions for temporary AWS security credentials.
2
Define encryption using a Customer Managed Key (CMK) in the destination account.
The S3 bucket in the Security Logging account (444455556666444455556666) is encrypted using a Customer Managed Key (CMK) instead of the default AWS managed key.
AWS managed keys (such as aws/s3) have fixed key policies that cannot be modified to permit access from external accounts. A Customer Managed Key must be used for cross-account decryption.
3
Grant outbound permissions to the federated IAM role.
Attach an IAM policy to the SecurityAuditorRole in the Identity account allowing s3:GetObject on the S3 bucket ARN and kms:Decrypt on the CMK ARN.
The IAM role must have explicit permission to retrieve objects and perform decrypt operations on the remote KMS key.
4
Grant inbound permissions in the resource policies of the destination account.
Update the S3 bucket policy to allow s3:GetObject for the SecurityAuditorRole ARN, and update the KMS key policy to allow kms:Decrypt for the SecurityAuditorRole ARN.
For cross-account access, both the IAM policy in the source account and the resource policies (S3 bucket policy and KMS key policy) in the target account must explicitly permit the access.

Key Concept

Cross-account access delegation with SAML federation and custom KMS key policies
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic