Examkin

Question

Difficulty: MediumEnhancing Data Protection and Compliance

A company has a multi-account AWS environment managed via AWS Organizations. Application servers in a Production account write sensitive compliance logs to an Amazon S3 bucket located in a dedicated Security account. The security team wants to enhance data protection and ensure the logs are encrypted at rest using a customer managed key (CMK) with automated rotation, while allowing the Production account to write to the bucket. Which two actions should the solutions architect take to meet these requirements?

  1. In the Security account, create a symmetric AWS KMS customer managed key, enable automatic key rotation, and configure the key policy to allow the Production account's IAM execution roles the kms:GenerateDataKey and kms:Decrypt actions.Answer
  2. In the Security account, configure the destination S3 bucket to use the newly created customer managed KMS key as the default encryption key, and configure the S3 bucket policy to allow the Production account's IAM execution roles to perform s3:PutObject actions.Answer
  3. C
    In the Security account, configure the destination S3 bucket to use the AWS managed key (aws/s3) for default encryption, and edit the aws/s3 key policy to grant the Production account cross-account access.
  4. D
    Attach a Service Control Policy (SCP) to the Production account's Organizational Unit (OU) that explicitly grants s3:PutObject and kms:GenerateDataKey permissions to the destination resources in the Security account, removing the need for local IAM policies.
  5. E
    In the Security account, update the S3 bucket policy to allow write access but omit the cross-account principal declarations, relying instead on enabling S3 ACLs to grant write permissions to the Production account.

Answer

Create a symmetric AWS KMS customer managed key in the Security account with automatic rotation and a key policy allowing the Production account roles access, and configure the destination S3 bucket default encryption with this key along with a bucket policy allowing cross-account writes.
To implement secure cross-account logging with encryption, a customer managed key (CMK) must be created in the target Security account because AWS-managed keys cannot be shared across accounts. The CMK key policy must grant permissions to the Production account's execution roles so they can generate data keys to encrypt logs. Additionally, the S3 bucket default encryption must be configured to use this CMK, and the S3 bucket policy must allow the Production roles to write objects.

Step-by-Step Solution

1
Provision a symmetric customer managed key (CMK) in the Security account.
A CMK is created which allows its key policy to be customized for cross-account usage.
AWS-managed KMS keys do not support policy modification and cannot be shared across AWS accounts.
2
Configure the key policy of the CMK and enable key rotation.
The Production account's IAM execution roles are granted permission to perform kms:GenerateDataKey and kms:Decrypt.
Enabling these permissions allows the cross-account servers to perform cryptographic operations required for writing encrypted files to S3.
3
Set up default encryption on the destination S3 bucket using the CMK, and configure the S3 bucket policy.
The S3 bucket enforces encryption via the CMK and grants cross-account write access to the Production roles.
This establishes a robust security posture where all uploaded logs are automatically encrypted with the compliant key and cross-account writes are permitted.

Key Concept

Cross-account resource sharing and data protection using customer managed KMS keys and resource policies.
Estimated Time:2m 0s
Rate this question

Topics

Enhancing Data Protection and Compliance