Examkin

Question

Difficulty: HardMulti-Account Identity and Access Management Federation

A logistics enterprise manages its multi-account environment within AWS Organizations. The enterprise has established SAML 2.0-based federation with its on-premises identity provider (IdP) to allow database administrators to access target AWS member accounts. Once federated, the administrators must access database backups stored in a centralized Amazon S3 bucket within a shared services account. The S3 bucket is encrypted using the default AWS-managed key (aws/s3). Currently, when the administrators federate into their respective member accounts, they are unable to retrieve the backup files from the shared services account. Which combination of configuration adjustments will resolve these access issues?

  1. Configure the S3 bucket in the shared services account to use a customer managed KMS key, and update its key policy to grant decrypt permissions to the member account's federated IAM role. In the member accounts, ensure the IAM role trust policy trusts the SAML provider with the sts:AssumeRoleWithSAML action, and attach a local IAM policy to the role that grants read access to the S3 bucket.Answer
  2. B
    Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level containing the member accounts that explicitly allows s3:GetObject and kms:Decrypt actions on the shared services account's resources. In the member accounts, configure the federated IAM role trust policy to trust the SAML provider with the sts:AssumeRoleWithSAML action, without attaching local IAM policies.
  3. C
    Configure the S3 bucket in the shared services account to use a customer managed KMS key, and update its key policy to grant decrypt permissions to the member account's federated IAM role. In the member accounts, configure the IAM role trust policy to trust the SAML provider with the sts:AssumeRole action, and attach a local IAM policy to the role that grants read access to the S3 bucket.
  4. D
    Modify the key policy of the AWS-managed key (aws/s3) in the shared services account to grant decrypt permissions to the member account's federated IAM role. In the member accounts, ensure the IAM role trust policy trusts the SAML provider with the sts:AssumeRoleWithSAML action, and attach a local IAM policy to the role that grants read access to the S3 bucket.

Answer

Configure the S3 bucket in the shared services account to use a customer managed KMS key, update its key policy to allow the federated role in the member account to decrypt the data, configure the member account's federated IAM role trust policy to allow sts:AssumeRoleWithSAML, and attach a local IAM policy allowing S3 access.
The correct solution involves transitioning the central S3 bucket's encryption to a customer managed KMS key, which allows key policy modification for cross-account access. The member account's federated role trust policy must also be configured with the correct SAML action (sts:AssumeRoleWithSAML) and local S3/KMS permissions must be attached.

Step-by-Step Solution

1
Change S3 bucket encryption from the default AWS-managed key (aws/s3) to a customer managed KMS key in the shared services account.
Enables the ability to customize the key policy to allow cross-account access, which is prohibited with the default AWS-managed key.
AWS-managed KMS keys cannot have their policies modified and cannot be accessed by external AWS accounts.
2
Modify the key policy of the customer managed KMS key in the shared services account to permit the federated IAM role in the member account to perform kms:Decrypt operations.
Delegates decryption permissions to the external principal.
For cross-account KMS access, both the key policy in the owning account and the IAM policy in the consuming account must allow the KMS action.
3
Configure the federated IAM role trust policy in the member accounts to use the sts:AssumeRoleWithSAML action and trust the SAML identity provider (IdP) principal.
Allows users authenticated via the corporate IdP to assume the IAM role using the SAML assertion.
SAML federation requires the specific sts:AssumeRoleWithSAML API action; standard sts:AssumeRole will fail.
4
Attach a local IAM policy to the federated role in the member accounts granting s3:GetObject on the centralized bucket and kms:Decrypt on the customer managed KMS key.
Gives the federated user identity the active permission to read the files and decrypt them.
An SCP or key policy alone does not grant permissions; the local IAM identity must also explicitly possess the permissions.

Key Concept

Cross-account access to encrypted S3 resources requires a customer managed KMS key combined with a correctly configured SAML trust policy utilizing sts:AssumeRoleWithSAML and local IAM policies.
Rate this question

Topics

Multi-Account Identity and Access Management Federation

More questions from this topic