Examkin

Question

Difficulty: EasySecurity and Compliance Control Design

A financial startup is launching a new processing service where a serverless ingestion application in a Development Account (123456789012123456789012) must write sensitive audit logs directly to a centralized Amazon S3 bucket in a Security Account (987654321098987654321098). The compliance requirements dictate that all uploaded objects must be encrypted at rest using a Customer Managed Key (CMK) in AWS KMS, and the security team must control key access and rotation. Which of the following configuration steps must be performed to enable this cross-account write access and encryption? (Select TWO.)

  1. In the Security Account, modify the key policy of the Customer Managed Key to grant the IAM role in the Development Account permissions to perform kms:GenerateDataKey and kms:Decrypt actions.Answer
  2. In the Security Account, configure the S3 bucket policy to allow the IAM role from the Development Account to perform s3:PutObject actions.Answer
  3. C
    In the Security Account, encrypt the S3 bucket using the AWS-managed KMS key for S3 (aws/s3), and allow the Development Account to use it by attaching an IAM policy to the Development role.
  4. D
    Create and attach a Service Control Policy (SCP) at the root of the organization that explicitly grants the IAM role in the Development Account the permission to write to the Security Account's S3 bucket.
  5. E
    In the Security Account, add a statement to the S3 bucket policy that grants the IAM role from the Development Account the kms:GenerateDataKey permission for the KMS key.

Answer

In the Security Account, modify the key policy of the Customer Managed Key to grant the IAM role in the Development Account permissions to perform kms:GenerateDataKey and kms:Decrypt actions, and configure the S3 bucket policy to allow the IAM role from the Development Account to perform s3:PutObject actions.
To allow cross-account access to encrypted S3 buckets, two permissions are required: first, the bucket policy in the destination account (Security Account) must explicitly allow the source account's IAM principal to perform write operations (such as `s3:PutObject`). Second, because a Customer Managed Key (CMK) is used for encryption, the key policy of the CMK in the destination account must be updated to grant the source account's IAM principal permission to generate data keys (`kms:GenerateDataKey`) and decrypt them (`kms:Decrypt`). S3 uses these KMS actions to encrypt the object during upload.

Step-by-Step Solution

1
Configure permissions on the destination S3 bucket in the Security Account (987654321098987654321098).
The S3 bucket policy allows the IAM role in the Development Account (123456789012123456789012) to perform s3:PutObject operations.
By default, cross-account access requires explicit permission in the resource-based policy of the target S3 bucket.
2
Configure cross-account permissions on the Customer Managed Key (CMK) in the Security Account.
The KMS key policy is updated to allow the IAM role in the Development Account to perform kms:GenerateDataKey and kms:Decrypt.
Since the bucket is encrypted using a Customer Managed Key, the client uploading objects must have permissions to generate data keys to encrypt the data before it is stored in S3.

Key Concept

Cross-account resource sharing and encryption control design using resource-based policies (S3 Bucket Policies) and KMS Key Policies.
Estimated Time:2m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic