Examkin

Question

Difficulty: HardEnhancing Data Protection and Compliance

A digital health platform hosts its application workloads in a production AWS account under an AWS Organizations structure. The application stores HIPAA-regulated patient health summaries in an Amazon S3 bucket. Currently, the bucket is encrypted using default server-side encryption with the AWS managed key (`aws/s3`). To comply with a new security directive, the platform's security officer requires that a compliance reporting service running in a separate, dedicated auditing AWS account must be able to read these health summaries. The encryption keys must support automatic rotation, and the policy must adhere strictly to the principle of least privilege. Which two actions should the solutions architect take to implement these changes?

  1. Create a symmetric customer managed key (CMK) in the production account, enable automatic key rotation, and configure the key policy to grant the auditing account's IAM role access to the `kms:Decrypt` action.Answer
  2. Configure the default encryption of the S3 bucket to use the new customer managed key, and update the S3 bucket policy in the production account to grant the auditing account's IAM role access to the `s3:GetObject` action.Answer
  3. C
    Modify the key policy of the existing AWS managed key (`aws/s3`) in the production account to delegate cross-account decryption access to the auditing account's IAM role.
  4. D
    Create a bucket policy on the S3 bucket in the auditing account to grant the auditing role `s3:GetObject` permissions, and configure a Service Control Policy (SCP) to enable cross-account access.
  5. E
    Enable cross-account sharing for the AWS managed key (`aws/s3`) in the production account using AWS Resource Access Manager (RAM), and grant the auditing role access to the key.

Answer

The correct actions are to create a symmetric customer managed key (CMK) in the production account with automatic rotation enabled, grant decryption permissions to the auditing account's IAM role in the key policy, update the S3 bucket default encryption to use this CMK, and update the production S3 bucket policy to grant the auditing role access to get the objects.
To retrieve encrypted objects from an S3 bucket in another account, the auditing IAM role must have permission in both the S3 bucket policy (`s3:GetObject`) and the KMS key policy (`kms:Decrypt`). Because the default AWS managed key (`aws/s3`) cannot be configured with a custom policy or shared cross-account, a symmetric customer managed key (CMK) must be created in the production account. Enabling automatic rotation on this CMK satisfies security policies, and updating the key policy grants the external account decryption capability. Updating the S3 bucket default encryption to the CMK and applying the bucket policy completes the access path.

Step-by-Step Solution

1
Analyze cross-account key sharing capabilities for AWS managed keys versus customer managed keys.
Identify that the default AWS managed key (`aws/s3`) cannot have its key policy modified and does not support cross-account sharing. Therefore, a customer managed key (CMK) is required.
AWS managed keys are locked to the local account and their policies are read-only.
2
Configure the customer managed key in the production account.
Provision a symmetric customer managed KMS key, enable annual automatic rotation, and update its key policy to explicitly grant the auditing account's IAM role permission to perform `kms:Decrypt`.
This satisfies the compliance requirement for key rotation and establishes cross-account decryption capabilities.
3
Configure the S3 bucket default encryption and access policy.
Change the default encryption settings of the S3 bucket to point to the new customer managed key, and update the S3 bucket policy in the production account to grant the auditing role the `s3:GetObject` permission.
This ensures S3 object access is granted cross-account, and that the data is encrypted with the correct key.

Key Concept

Cross-account access to encrypted Amazon S3 resources requires both S3 bucket policy permissions and KMS customer managed key (CMK) policy decryption permissions, as AWS managed KMS keys cannot be shared across accounts.
Rate this question

Topics

Enhancing Data Protection and Compliance