Examkin

Question

Difficulty: Very hardSecurity and Compliance Control Design

A medical device manufacturing company is establishing a centralized telemetry logging architecture. An application running on Amazon ECS tasks within a Production VPC in Account A (444455556666444455556666) needs to write encrypted raw patient telemetry data directly to an Amazon S3 bucket located in a dedicated Security and Auditing account, Account B (111122223333111122223333). The compliance officer requires that all data uploaded must be owned by Account B immediately upon creation to prevent Account A from deleting or modifying the logs. The data must be encrypted at rest using a customer-managed KMS key (CMK). The ECS tasks in Account A must only have the minimum permissions required to perform the write and encryption operations, with no read or delete capabilities on Account B's resources. Which two configuration steps must the Solutions Architect implement to meet these requirements securely?

  1. In Account B, set the S3 Object Ownership to Bucket Owner Enforced to disable Access Control Lists (ACLs), and configure a bucket policy that grants s3:PutObject permissions specifically to Account A's ECS task role.Answer
  2. In Account B, create a Customer Managed Key (CMK) with a key policy that grants Account A's ECS task role permissions for the kms:GenerateDataKey and kms:Decrypt actions, and configure the S3 bucket to use this CMK as the default encryption key.Answer
  3. C
    In Account B, configure the S3 bucket to use the default AWS-managed KMS key (aws/s3) for S3 default encryption, and attach an IAM policy to the ECS task role in Account A that grants access to this key.
  4. D
    In the AWS Organizations management account, attach a Service Control Policy (SCP) to Account A that explicitly grants s3:PutObject and kms:GenerateDataKey access to Account B's S3 bucket and KMS key.
  5. E
    In Account B, configure the S3 bucket policy with a wildcard principal (*) and rely on the KMS key policy's principal restrictions to secure access, omitting explicit Account A principal declarations or organizational conditions in the S3 bucket policy.

Answer

In Account B, set S3 Object Ownership to Bucket Owner Enforced, configure a bucket policy that grants s3:PutObject permissions to Account A's ECS task role, create a Customer Managed Key (CMK) in Account B with a key policy allowing Account A's ECS task role to perform kms:GenerateDataKey and kms:Decrypt, and configure the S3 bucket to use this CMK by default.
To implement write-only cross-account uploads with automatic ownership transfer, the destination S3 bucket must disable ACLs by setting Object Ownership to Bucket Owner Enforced. This automatically transfers ownership of uploaded objects to Account B. A bucket policy must grant s3:PutObject permissions to the uploading role. Additionally, because default AWS-managed keys (aws/s3) cannot be shared across accounts, a Customer Managed Key (CMK) must be created in Account B. Its key policy must explicitly grant the uploading role both kms:GenerateDataKey and kms:Decrypt permissions to support S3 multipart uploads.

Step-by-Step Solution

1
Disable S3 ACLs in the destination bucket by setting Object Ownership to Bucket Owner Enforced.
Ownership of all uploaded objects automatically transfers to the bucket owner (Account B), preventing the uploading account (Account A) from maintaining control or deleting the logs.
To satisfy the compliance requirement that Account B must own all uploaded objects immediately and prevent modification or deletion by Account A.
2
Configure the S3 bucket policy in Account B to allow cross-account write access.
Grants s3:PutObject permissions to Account A's ECS task role.
Since ACLs are disabled, IAM and S3 bucket policies are the sole mechanisms to authorize cross-account access.
3
Create a Customer Managed Key (CMK) in Account B and configure its key policy to allow cross-account access.
Grants the ECS task role in Account A permissions to generate data keys and decrypt objects (needed for multipart uploads).
AWS-managed keys (aws/s3) cannot be shared cross-account, so a CMK is required to support cross-account S3 bucket encryption.
4
Configure the S3 bucket default encryption to use the newly created Customer Managed Key (CMK).
Enforces automatic encryption at rest using the CMK for all uploaded objects.
Ensures compliance with data-at-rest encryption requirements using the shared CMK.

Key Concept

Cross-account security controls using S3 Object Ownership (Bucket Owner Enforced) and Customer Managed Keys (CMKs) key policies.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic