Examkin

Question

Difficulty: Very hardSecurity and Compliance Control Design

A pharmaceutical company is launching a new research platform using AWS Organizations. The architecture requires a compliance auditing application hosted on an Amazon Elastic Container Service (ECS) cluster running on AWS Fargate in the Compliance account (444444444444444444444444) to regularly analyze raw clinical research data stored in an Amazon S3 bucket within the Research account (555555555555555555555555). The clinical research data is encrypted at rest using AWS KMS. The security policy mandates that all access to the S3 bucket must be restricted to authorized roles, and the ECS task role in the Compliance account must have read-only access to the S3 bucket and be able to decrypt the objects. An SCP is attached to the Research OU that allows KMS decryption actions. Which of the following configurations will securely enable the ECS task role to access and decrypt the S3 objects?

  1. In the Research account, create a Customer Managed Key (CMK) and configure its key policy to grant the Compliance account's ECS task role (arn:aws:iam::444444444444:role/EcsTaskRole) permission for kms:Decrypt. In the Research account, update the S3 bucket policy to grant s3:GetObject to the ECS task role. In the Compliance account, attach an IAM policy to the ECS task role that allows s3:GetObject on the Research S3 bucket and kms:Decrypt on the Research CMK.Answer
  2. B
    In the Research account, enable default encryption on the S3 bucket using the AWS-managed KMS key for S3 (aws/s3). Update the S3 bucket policy in the Research account to allow the Compliance account's ECS task role (arn:aws:iam::444444444444:role/EcsTaskRole) to perform s3:GetObject. In the Compliance account, attach an IAM policy to the ECS task role allowing s3:GetObject and kms:Decrypt on the S3 bucket and the aws/s3 key.
  3. C
    In the Research account, create a Customer Managed Key (CMK). Attach a Service Control Policy (SCP) to the Research OU that explicitly allows the Compliance account's ECS task role (arn:aws:iam::444444444444:role/EcsTaskRole) to perform s3:GetObject and kms:Decrypt actions on the Research S3 bucket and CMK. Configure an IAM policy on the Compliance ECS task role with these permissions.
  4. D
    In the Research account, create a Customer Managed Key (CMK). Configure the CMK key policy to trust the Research account root principal (arn:aws:iam::555555555555:root) to delegate permissions. Update the S3 bucket policy to allow the Compliance account root principal (arn:aws:iam::444444444444:root) to perform s3:GetObject. In the Compliance account, attach an IAM policy to the ECS task role allowing s3:GetObject on the bucket and kms:Decrypt on the CMK.

Answer

In the Research account, create a Customer Managed Key (CMK) and configure its key policy to grant the Compliance account's ECS task role permission for kms:Decrypt. In the Research account, update the S3 bucket policy to grant s3:GetObject to the ECS task role. In the Compliance account, attach an IAM policy to the ECS task role that allows s3:GetObject on the Research S3 bucket and kms:Decrypt on the Research CMK.
The correct configuration establishes a complete trust chain for cross-account access: the Research account's S3 bucket policy allows the Compliance ECS task role to perform s3:GetObject, the Research CMK key policy allows the ECS task role to perform kms:Decrypt, and the Compliance account's IAM policy grants the ECS task role the necessary permissions to call these resources. A Customer Managed Key (CMK) is used because AWS-managed keys cannot be shared across accounts.

Step-by-Step Solution

1
Select a key type that supports cross-account delegation.
Choose a Customer Managed Key (CMK) instead of the AWS-managed KMS key for S3 (aws/s3), because AWS-managed keys cannot be shared across accounts.
AWS-managed keys have key policies that cannot be modified, which makes cross-account decryption impossible.
2
Configure permissions in the trust-owning account (Research account).
Update the S3 bucket policy to allow the Compliance ECS task role to perform s3:GetObject, and configure the CMK key policy to allow the Compliance ECS task role to perform kms:Decrypt.
Cross-account access to S3 and KMS requires the resource owner to explicitly trust the external principal.
3
Configure permissions in the calling account (Compliance account).
Attach an IAM policy to the ECS task role that grants s3:GetObject on the Research S3 bucket and kms:Decrypt on the Research CMK.
The IAM principal must be granted local permission to execute these actions on the remote resources.

Key Concept

Cross-account access with KMS encryption requires explicit authorization in the resource-owning account's policies (S3 bucket policy and KMS key policy) and the caller account's IAM policy, and cannot utilize AWS-managed keys.
Estimated Time:3m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic