Examkin

Question

Difficulty: HardStrengthening Identity, Access, and Network Security

An enterprise has a multi-account AWS Organizations structure. An application hosted on Amazon EC2 instances in private subnets of a production VPC needs to read and write sensitive files in an Amazon S3 bucket. Currently, the S3 bucket is configured with default encryption using the AWS-managed key (aws/s3). The production VPC is connected to an on-premises data center via AWS Transit Gateway.

The security team has established the following new security mandates for this workload:
1. All S3 bucket access must be restricted to the production VPC, preventing public internet access or access from other VPCs.
2. The S3 data must be encrypted using a key that supports rotation and cross-account access delegated to a central security account.
3. On-premises client machines must be able to securely access the S3 bucket through the Transit Gateway connection and resolve the bucket's DNS names.

Which two actions should the solutions architect take to meet these requirements? (Select two.)

  1. Create an S3 Interface VPC endpoint in the production VPC. Set up a Route 53 Resolver Inbound Endpoint in the production VPC to allow the on-premises DNS servers to resolve the private DNS names of the S3 endpoint.Answer
  2. In the central security account, create a Customer Managed KMS key. Configure the key policy to allow the production account's application IAM role to perform cryptographic operations. Update the S3 bucket's default encryption configuration to use this key.Answer
  3. C
    Configure the S3 bucket's default encryption to use the AWS-managed key (aws/s3) in the central security account, and grant the application IAM role access to the key using an IAM policy in the production account.
  4. D
    Create an S3 Gateway VPC endpoint in the production VPC. Associate the gateway endpoint with the production VPC's route tables, and configure Route 53 Resolver Outbound Endpoints to forward S3 DNS queries from on-premises to the VPC.
  5. E
    Create a Service Control Policy (SCP) in the central security Organization root that explicitly allows the production account's IAM role to perform cryptographic operations on the AWS-managed S3 key, and attach this SCP to the production OU.

Answer

Create an S3 Interface VPC endpoint combined with a Route 53 Resolver Inbound Endpoint, and create a Customer Managed KMS key in the central security account with a key policy allowing the production account's application IAM role access.
To satisfy both network and identity security requirements: First, S3 Interface VPC endpoints (PrivateLink) are required for on-premises client access over AWS Transit Gateway because S3 Gateway VPC endpoints do not support routing from on-premises networks. A Route 53 Resolver Inbound Endpoint must be created in the VPC to allow on-premises DNS servers to forward queries to resolve S3 endpoint names. Second, a Customer Managed KMS key in the central security account must be used because AWS-managed keys (such as aws/s3) cannot be shared across accounts. A key policy on the Customer Managed KMS key must explicitly grant permissions to the production account's application IAM role.

Step-by-Step Solution

1
Evaluate S3 access path and connectivity requirements from on-premises.
Determine that S3 Gateway VPC endpoints cannot handle traffic originating from on-premises via VPN or Transit Gateway. Select an S3 Interface VPC endpoint (PrivateLink) instead, which generates private IPs in the VPC that are routable over Transit Gateway.
Ensures that on-premises clients can reach S3 privately and securely.
2
Address DNS resolution for on-premises clients.
Configure a Route 53 Resolver Inbound Endpoint in the production VPC and configure on-premises DNS forwarders.
Allows on-premises DNS queries to resolve the private IP addresses of the S3 Interface VPC endpoint.
3
Analyze cross-account KMS encryption requirement.
Recognize that AWS-managed KMS keys (aws/s3) cannot be shared cross-account because their policies cannot be edited. Decide to use a Customer Managed Key (CMK) in the central security account.
Satisfies the security mandate of using a key with cross-account access and custom rotation rules.
4
Configure cross-account KMS permissions.
Add the production application's IAM role ARN as a key user in the central account's CMK policy, and configure default encryption on the S3 bucket to target this KMS key.
Grants the necessary encrypt/decrypt permissions securely across accounts.

Key Concept

Cross-account KMS key sharing and private hybrid connectivity to S3 via Interface VPC Endpoints and Route 53 Resolver Inbound Endpoints
Rate this question

Topics

Strengthening Identity, Access, and Network Security