Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A medical research organization, Aegis Health Group, is designing a secure cross-account data sharing solution. A research application running on Amazon EC2 instances under an IAM role in Account A needs to read sensitive clinical trial datasets stored in an Amazon S3 bucket located in Account B. The S3 bucket is encrypted using a Customer Managed Key (CMK) generated in AWS KMS within Account B. The architecture must enforce the principle of least privilege and comply with healthcare data protection standards. Which combination of configuration steps is required to successfully establish this cross-account access? (Select TWO.)

  1. In Account B, configure the S3 bucket policy to grant the IAM role in Account A permissions to perform s3:GetObject on the target S3 bucket objects.Answer
  2. In Account B, update the Customer Managed Key (CMK) key policy to delegate permission to Account A, allowing the IAM role in Account A to perform kms:Decrypt and kms:DescribeKey actions.Answer
  3. C
    In Account B, encrypt the S3 bucket using the default AWS-managed KMS key (aws/s3) and grant Account A decrypt permissions via Account A's local IAM policy.
  4. D
    Attach a Service Control Policy (SCP) to the Organizational Unit containing Account A that explicitly grants cross-account s3:GetObject and kms:Decrypt access to Account B's S3 bucket and CMK.
  5. E
    In Account B, configure the S3 bucket policy to grant read access to the root principal of Account A, and rely solely on Account A's local IAM policy to allow S3 and KMS actions without modifying the CMK key policy in Account B.

Answer

Configure the S3 bucket policy in Account B to grant access to the IAM role in Account A, and configure the Customer Managed Key (CMK) key policy in Account B to delegate decrypt permissions to the IAM role in Account A.
The correct solution requires configuring the S3 bucket policy in Account B to grant access to the IAM role in Account A, and updating the KMS Customer Managed Key (CMK) key policy in Account B to delegate decrypt permissions to the IAM role in Account A. Together, these steps satisfy the cross-account S3 and KMS requirements.

Step-by-Step Solution

1
Configure the S3 bucket policy in Account B (the resource owner) to trust and permit the specific IAM role from Account A to execute S3 operations.
The IAM role in Account A passes the first layer of cross-account authorization for S3 access.
For cross-account access, S3 requires authorization from the resource policy (bucket policy) of the owning account.
2
Modify the key policy of the KMS Customer Managed Key (CMK) in Account B to allow the IAM role in Account A to decrypt objects.
The IAM role in Account A passes the KMS decryption authorization layer.
Since the objects are encrypted with a CMK, the caller needs both S3 read permissions and KMS decrypt permissions, both of which must be explicitly allowed by the resource policy of the KMS key.
3
Ensure the IAM role's policy in Account A grants permission to read the S3 bucket and decrypt using the Account B KMS CMK ARN.
The caller has local permission to initiate the API calls to S3 and KMS in Account B.
Cross-account access requires permissions to be granted on both the trust/resource side (Account B) and the identity/caller side (Account A).

Key Concept

Cross-account resource access with S3 and KMS Customer Managed Keys
Estimated Time:2m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic