Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

An enterprise SaaS company is building a collaborative video processing pipeline across multiple AWS accounts within an AWS Organizations organization. The media ingestion application runs on Amazon EC2 instances in Account A (AWS account ID: 111122223333111122223333) and must upload raw media files directly to an Amazon S3 bucket located in Account B (AWS account ID: 444455556666444455556666).

The following security controls are required:
1. All objects uploaded to the S3 bucket must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) located in Account B.
2. The S3 bucket owner (Account B) must automatically own all uploaded objects and have full control over them, disabling access control lists (ACLs).
3. The ingestion application's IAM role in Account A must have the minimum necessary privileges to perform the uploads and encrypt the objects.

Which combination of actions must the Solutions Architect perform to meet these requirements? (Select TWO.)

  1. In Account B, configure the KMS Customer Managed Key policy to grant the ingestion application's IAM role in Account A permissions to perform the kms:GenerateDataKey and kms:Decrypt actions.Answer
  2. In Account B, configure the S3 bucket to use the Bucket Owner Enforced setting for S3 Object Ownership, and update the bucket policy to grant s3:PutObject permissions to the ingestion application's IAM role in Account A.Answer
  3. C
    In Account B, configure the S3 bucket to use the AWS-managed KMS key for Amazon S3 (aws/s3) for default encryption, and configure the bucket policy to delegate cross-account access to Account A.
  4. D
    In AWS Organizations, attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account A that explicitly allows the ingestion application's IAM role to perform s3:PutObject and kms:GenerateDataKey actions.
  5. E
    In Account B, configure the S3 bucket policy with the Principal set to a wildcard '*' and use the aws:PrincipalOrgID condition key, relying on Account A's local IAM policy to restrict write access to the ingestion application.

Answer

Configure the KMS Customer Managed Key policy in Account B to allow the ingestion application's IAM role in Account A to perform kms:GenerateDataKey and kms:Decrypt actions, and configure S3 Object Ownership with Bucket Owner Enforced alongside a bucket policy in Account B granting write access to the application's IAM role.
For cross-account S3 uploads using SSE-KMS, the uploading principal in Account A requires permissions from both the KMS key policy and the S3 bucket policy in Account B. Because AWS-managed keys cannot be shared across accounts, a Customer Managed Key (CMK) must be used, and its key policy must allow the IAM role in Account A to generate data keys and decrypt. Enabling S3 Object Ownership with Bucket Owner Enforced disables ACLs, ensuring Account B automatically owns all uploaded files and has full control over them.

Step-by-Step Solution

1
Evaluate the encryption requirements for cross-account KMS operations.
Identify that a Customer Managed Key in Account B must be used because AWS-managed keys cannot be shared cross-account. The KMS key policy in Account B must be updated to allow the IAM role in Account A to use the key.
KMS key policies control cross-account delegation. Without this permission, S3 SSE-KMS uploads from Account A will fail with an Access Denied error.
2
Evaluate the ownership requirement.
Select the Bucket Owner Enforced setting for S3 Object Ownership in Account B.
This setting disables all ACLs and ensures that the bucket owner automatically owns all objects written to the bucket, regardless of which account uploaded them.
3
Establish the resource-based access policy on the S3 bucket.
Create a bucket policy in Account B that permits the specific ingestion application IAM role in Account A to perform s3:PutObject.
For cross-account access, both the IAM policy in the source account and the resource policy (bucket policy) in the target account must permit the action.

Key Concept

To establish cross-account writing and encryption in AWS, resource policies in the target account must explicitly grant permissions to the source principal. AWS-managed keys cannot be used cross-account. Using S3 Object Ownership (Bucket Owner Enforced) simplifies object permissions by disabling ACLs.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic