Examkin

Question

Difficulty: Very hardSecurity and Compliance Control Design

A global financial conglomerate is designing a compliance-audited transaction archiving system. An application running on AWS Fargate in the Transaction Processing Account (111111111111) must write hourly transaction logs to an Amazon S3 bucket in a central Audit Account (222222222222). The compliance mandates require that:
1. All logs must be encrypted at rest using a customer managed key (CMK) in AWS KMS. The CMK must reside in the Audit Account.
2. The Fargate task role in the Transaction Processing Account must have the minimum necessary permissions to write the logs but must not be able to read or modify any logs in the S3 bucket.
3. The Audit Account must automatically own all uploaded logs, and all Access Control Lists (ACLs) must be disabled on the bucket.
4. The KMS key policy must enforce least privilege, allowing only the Fargate task role and the Audit Account's administrators to use the key.

Which of the following configurations meets these requirements?

  1. In the Audit Account, configure S3 Object Ownership to Bucket Owner Enforced on the destination bucket. Create a customer managed KMS key in the Audit Account and configure its key policy to grant the Fargate task role ARN in the Transaction Processing Account permissions for kms:GenerateDataKey and kms:Decrypt. In the Audit Account's S3 bucket policy, grant the Fargate task role ARN permission for s3:PutObject. In the Transaction Processing Account, attach an IAM policy to the Fargate task role allowing s3:PutObject on the Audit bucket and kms:GenerateDataKey and kms:Decrypt on the Audit Account's KMS key.Answer
  2. B
    In the Audit Account, configure S3 Object Ownership to Bucket Owner Enforced on the destination bucket. Encrypt the S3 bucket using the default AWS managed KMS key (aws/s3). Configure the S3 bucket policy in the Audit Account to grant the Fargate task role ARN permission for s3:PutObject. In the Transaction Processing Account, configure the Fargate task role's IAM policy to allow s3:PutObject on the Audit bucket and kms:GenerateDataKey on the aws/s3 key.
  3. C
    In the Audit Account, create a customer managed KMS key. In the AWS Organizations root, apply a Service Control Policy (SCP) to the Organizational Unit containing both accounts that explicitly grants s3:PutObject and kms:GenerateDataKey permissions to the Fargate task role ARN. Rely on this SCP to grant the necessary write permissions to the Transaction Processing Account's Fargate tasks without configuring the local S3 bucket policy or the KMS key policy.
  4. D
    In the Audit Account, create a customer managed KMS key. In the KMS key policy, grant the Fargate task role ARN permissions for kms:GenerateDataKey and kms:Decrypt. In the S3 bucket policy, grant s3:PutObject permission to the AWS Organization ID principal using the aws:PrincipalOrgID condition key, but do not configure S3 Object Ownership, instead requiring the Fargate tasks to supply the bucket-owner-full-control canned ACL in their upload requests.

Answer

The correct configuration uses S3 Bucket Owner Enforced to disable ACLs and transfer ownership, uses a customer managed KMS key in the destination account with policy permissions explicitly granted to the cross-account role, and configures matching local IAM and bucket policies for the Fargate task role.
The correct configuration uses S3 Object Ownership set to Bucket Owner Enforced, which successfully disables ACLs and ensures that the Audit Account automatically owns all uploaded files. Since AWS-managed keys cannot be shared across accounts, a customer managed key is deployed in the Audit Account. The key policy is modified to grant the Fargate task role in the Transaction Processing Account permissions for kms:GenerateDataKey and kms:Decrypt (which are necessary to initiate and complete multipart S3 uploads). Matching IAM policies in the source account and S3 bucket policies in the destination account ensure the write-only trust relationship is authorized.

Step-by-Step Solution

1
Disable ACLs on the destination S3 bucket in the Audit Account.
Configure S3 Object Ownership to Bucket Owner Enforced. This automatically transfers ownership of all cross-account uploaded objects to the Audit Account and disables ACLs.
This satisfies the requirement to disable all ACLs and automatically assign ownership of all written objects to the Audit Account.
2
Create and configure a Customer Managed Key (CMK) in the Audit Account.
Create the KMS CMK. Modify its key policy to explicitly grant the Fargate task role ARN from the Transaction Processing Account permission to perform kms:GenerateDataKey and kms:Decrypt.
An AWS managed key (aws/s3) cannot be shared cross-account. The external role needs kms:GenerateDataKey and kms:Decrypt to write encrypted objects (including multipart uploads) to the bucket.
3
Configure the S3 bucket policy in the Audit Account.
Add a statement to the bucket policy granting the specific Fargate task role ARN permission for s3:PutObject.
This establishes the necessary trust boundary and allows cross-account write access strictly for the designated application role.
4
Configure the IAM policy of the Fargate task in the Transaction Processing Account.
Attach an IAM policy to the Fargate task role permitting s3:PutObject on the Audit S3 bucket and kms:GenerateDataKey/kms:Decrypt on the Audit Account KMS key ARN.
IAM permissions must exist in the source account to authorize outbound requests to external resources.

Key Concept

Cross-account security and compliance control design using S3 Object Ownership (Bucket Owner Enforced), Customer Managed KMS Keys, and explicit resource policies.
Estimated Time:3m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic