An enterprise runs a microservice application hosted on Amazon ECS tasks in Account A. The microservice processes messages from an Amazon SQS queue in Account B. Currently, the SQS queue is encrypted using the default AWS-managed KMS key (aws/sqs), and network traffic travels over the public internet. The company's security policy requires that all network traffic between the ECS tasks and the SQS queue remains private within the AWS network, and access to the queue must be restricted to only the ECS tasks via a specific network path. Which combination of actions will meet these security requirements?
- AConfigure an interface VPC endpoint for SQS in Account A's VPC. Retain the AWS-managed KMS key on the SQS queue in Account B, and update the KMS key policy to grant the ECS task role in Account A permissions to decrypt and generate data keys. Update the SQS queue policy in Account B to allow access from the ECS task role in Account A, and add a condition that restricts requests to the SQS VPC endpoint ID using the aws:sourceVpce condition key.
- Configure an interface VPC endpoint for SQS in Account A's VPC. Replace the AWS-managed KMS key on the SQS queue in Account B with a Customer Managed Key, and update its key policy to grant the ECS task role in Account A permissions to decrypt and generate data keys. Update the SQS queue policy in Account B to allow access from the ECS task role in Account A, and add a condition that restricts requests to the SQS VPC endpoint ID using the aws:sourceVpce condition key.Answer
- CConfigure an interface VPC endpoint for SQS in Account A's VPC. Replace the AWS-managed KMS key on the SQS queue in Account B with a Customer Managed Key. Apply a Service Control Policy at the Organization root that allows cross-account SQS and KMS access between Account A and Account B, relying on the Service Control Policy to grant the ECS task role the necessary permissions to access the queue and the Customer Managed Key.
- DConfigure an interface VPC endpoint for SQS in a central transit VPC connected to Account A's VPC via AWS Transit Gateway. Enable Private DNS on the SQS interface VPC endpoint, but do not associate the resulting Route 53 Private Hosted Zone with Account A's VPC. Update the SQS queue policy in Account B to allow access from the ECS task role in Account A, and add a condition that restricts requests to the SQS VPC endpoint ID using the aws:sourceVpce condition key.
Answer
Configure an interface VPC endpoint in the application's VPC, use a Customer Managed Key for queue encryption with cross-account access granted in the key policy, and update the SQS queue policy to permit the application's ECS task role while restricting access to the VPC endpoint ID.
The correct solution involves creating an interface VPC endpoint in Account A to route the traffic privately, using a Customer Managed Key in Account B (since AWS-managed keys cannot be shared cross-account), and updating the SQS queue policy to authorize the ECS task role with a condition specifying the VPC endpoint ID.
Step-by-Step Solution
Key Concept
Cross-account access to encrypted SQS queues using VPC endpoints requires a Customer Managed KMS Key (since AWS-managed keys cannot be shared across accounts) and an SQS resource policy that explicitly trusts the external principal while conditionally restricting network access to the VPC endpoint ID.