Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A smart-home IoT provider is building a telemetry analysis dashboard. The architecture requires a serverless application running in the Analytics Account to retrieve encrypted device logs from an Amazon S3 bucket located in the Operations Account. The Operations Account encrypts the S3 bucket using an AWS KMS Customer Managed Key (CMK). The design must follow the principle of least privilege and allow secure cross-account access to the logs. Which combination of configuration steps will securely permit the Analytics Account to read these logs?

  1. In the Operations Account, configure the S3 bucket policy to allow s3:GetObject access to the Analytics IAM role, and configure the CMK key policy to allow kms:Decrypt access to the Analytics IAM role. In the Analytics Account, attach an IAM policy to the IAM role that grants s3:GetObject on the Operations bucket and kms:Decrypt on the Operations CMK.Answer
  2. B
    In the Operations Account, configure the S3 bucket policy to allow s3:GetObject access to the Analytics IAM role, and configure the bucket to encrypt objects with the AWS managed key (aws/s3). In the Analytics Account, attach an IAM policy to the IAM role that grants s3:GetObject on the Operations bucket and kms:Decrypt on the AWS managed key.
  3. C
    In the Operations Account, attach a Service Control Policy (SCP) to the organizational unit (OU) containing the Operations Account that explicitly grants the Analytics IAM role s3:GetObject and kms:Decrypt permissions. In the Analytics Account, configure the IAM role to trust the Operations Account.
  4. D
    In the Operations Account, configure the S3 bucket policy to allow s3:GetObject access to the Analytics IAM role, and leave the CMK key policy at its default settings. In the Analytics Account, attach an IAM policy to the IAM role that grants s3:GetObject on the Operations bucket, relying on the default CMK key policy to inherit cross-account access.

Answer

In the Operations Account, configure the S3 bucket policy to allow s3:GetObject access to the Analytics IAM role, and configure the CMK key policy to allow kms:Decrypt access to the Analytics IAM role. In the Analytics Account, attach an IAM policy to the IAM role that grants s3:GetObject on the Operations bucket and kms:Decrypt on the Operations CMK.
The correct answer correctly specifies the configuration of the three policy layers required for cross-account S3 bucket access with KMS encryption: the S3 bucket policy, the KMS key policy, and the local IAM identity policy. Each must explicitly allow the cross-account operations.

Step-by-Step Solution

1
Select the correct key type for cross-account S3 access.
Use a Customer Managed Key (CMK) instead of an AWS managed key.
AWS managed keys cannot have their key policies modified and therefore cannot support cross-account decryption.
2
Configure policies in the Operations Account (resource owner).
Update the S3 bucket policy to allow s3:GetObject for the Analytics role, and update the CMK key policy to allow kms:Decrypt for the Analytics role.
Cross-account resource access requires the resource-owning account to explicitly trust and grant permission to the external account or role.
3
Configure policies in the Analytics Account (consuming client).
Attach an IAM policy to the Analytics IAM role allowing s3:GetObject and kms:Decrypt on the Operations resources.
For cross-account access, both the resource-based policies and the identity-based policy must explicitly grant the required permissions.

Key Concept

Cross-account access controls involving S3 and KMS CMK encryption
Estimated Time:2m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic