A healthcare provider is establishing a centralized patient records archiving platform. Medical reports generated by application servers in the Processing account are uploaded to an Amazon S3 bucket located in the Archival account. To meet HIPAA compliance, all archived objects must be encrypted at rest using a Customer Managed Key (CMK) managed in a centralized Security account. A data auditing application running on Amazon ECS tasks in a separate Auditing account requires read access to these archived reports.
Which combination of policy configurations must be implemented to allow the ECS tasks in the Auditing account to retrieve and decrypt the records?
- Configure the S3 bucket policy in the Archival account to allow s3:GetObject for the ECS task role in the Auditing account. Configure the KMS key policy in the Security account to allow kms:Decrypt for the ECS task role. Attach an IAM policy to the ECS task role in the Auditing account that grants s3:GetObject on the S3 bucket and kms:Decrypt on the KMS CMK.Answer
- BConfigure the S3 bucket to use the default AWS-managed key aws/s3 in the Security account to encrypt the objects. Configure the S3 bucket policy in the Archival account to allow s3:GetObject for the Auditing account's ECS task role, and attach an IAM policy to the ECS task role allowing s3:GetObject on the S3 bucket.
- CAttach a Service Control Policy (SCP) at the Organizational Unit (OU) level containing both the Archival and Auditing accounts that explicitly allows s3:GetObject and kms:Decrypt actions. Remove the explicit KMS key policy statements in the Security account and S3 bucket policies in the Archival account to simplify administration.
- DConfigure the S3 bucket policy in the Archival account to allow s3:GetObject and kms:Decrypt for the Auditing account's ECS task role. Attach an IAM policy to the ECS task role in the Auditing account allowing s3:GetObject on the S3 bucket and kms:Decrypt on the KMS CMK in the Security account.
Answer
Configure the S3 bucket policy in the Archival account to allow s3:GetObject for the ECS task role in the Auditing account. Configure the KMS key policy in the Security account to allow kms:Decrypt for the ECS task role. Attach an IAM policy to the ECS task role in the Auditing account that grants s3:GetObject on the S3 bucket and kms:Decrypt on the KMS CMK.
To successfully read an S3 object encrypted with a KMS CMK when the caller, the S3 bucket, and the KMS key are all in different accounts, permissions must be explicitly granted at three trust boundaries: the caller's IAM policy must allow both S3 and KMS actions, the S3 bucket policy must allow the cross-account caller to retrieve objects, and the KMS key policy must allow the cross-account caller to decrypt.
Step-by-Step Solution
Key Concept
Cross-account access to KMS-encrypted S3 objects requires explicit authorization at the caller's IAM policy, the S3 bucket policy, and the KMS key policy, using a Customer Managed Key (CMK) since AWS-managed keys cannot be shared across accounts.