Examkin

Question

Difficulty: MediumEnhancing Data Protection and Compliance

An enterprise architecture includes a centralized logging bucket in Account A that collects data from multiple secondary AWS accounts within the same AWS Organization. The S3 bucket is configured with Server-Side Encryption using AWS KMS (SSE-KMS) with the default AWS-managed key (`aws/s3`). During a security audit, it is noted that while secondary accounts can write to the bucket, they cannot read or decrypt the objects they uploaded. Additionally, the security team requires the ability to rotate the encryption keys and enforce key rotation policies. Which configuration change will resolve the decryption issue and meet the compliance requirements?

  1. A
    Modify the key policy of the default AWS-managed key (`aws/s3`) to grant decrypt permissions to the cross-account IAM principals, and enable automatic annual key rotation.
  2. Transition the S3 bucket encryption to a Customer Managed Key (CMK) in AWS KMS, configure the key policy to grant decrypt permissions to the cross-account IAM principals, and update the bucket policy to permit cross-account access.Answer
  3. C
    Attach a Service Control Policy (SCP) at the Organizational Unit level that grants the `kms:Decrypt` action for the `aws/s3` key to the secondary accounts, overriding the key policy restrictions.
  4. D
    Update only the S3 bucket policy in Account A to delegate access to the cross-account principals, as S3 bucket policies automatically delegate permissions to KMS keys used for SSE-KMS without modifying the key policies.

Answer

Transition the S3 bucket encryption to a Customer Managed Key (CMK) in AWS KMS, configure the key policy to grant decrypt permissions to the cross-account IAM principals, and update the bucket policy to permit cross-account access.
Transitioning to a Customer Managed Key (CMK) is required because AWS managed keys (such as `aws/s3`) do not support modifying their key policies to grant cross-account access. By using a CMK, the key owner can update the key policy to allow external accounts to perform decryption and encryption actions, while also satisfying the compliance requirement for key rotation.

Step-by-Step Solution

1
Identify the limitation of AWS-managed keys.
The default AWS-managed key `aws/s3` cannot be used because its key policy cannot be modified to grant cross-account access.
Security and compliance requirements dictate that cross-account IAM principals must be granted decrypt permissions, which is only possible with Customer Managed Keys.
2
Establish a Customer Managed Key (CMK) and define its key policy.
A new KMS Customer Managed Key is created with key rotation enabled, and the key policy is configured to allow the external AWS accounts access to `kms:Decrypt` and `kms:GenerateDataKey`.
This enables cross-account decrypt capabilities and meets the rotation policy compliance goal.
3
Configure the S3 Bucket Policy to align with the access requirements.
The S3 bucket policy in Account A is updated to permit cross-account uploads and access.
For cross-account access to KMS-encrypted S3 objects, permissions must be explicitly granted on both the S3 bucket policy and the KMS key policy.

Key Concept

Cross-account KMS authorization using Customer Managed Keys (CMKs) in S3 SSE-KMS configurations.
Estimated Time:2m 0s
Rate this question

Topics

Enhancing Data Protection and Compliance