Examkin

Question

Difficulty: EasyStrengthening Identity, Access, and Network Security

An enterprise uses AWS Organizations to manage multiple AWS accounts. The security team needs to improve the security posture of an existing architecture. Specifically, they must address two security findings:

1. Sensitive compliance logs stored in a central Amazon S3 bucket are currently encrypted using the default AWS-managed KMS key (`aws/s3`), which prevents other accounts from decrypting the logs during audits.
2. Developers in member accounts can still configure Amazon S3 buckets to be publicly accessible, violating company policy.

Which two actions should a solutions architect take to resolve these security findings? (Select two.)

  1. Create a customer managed key (CMK) in AWS Key Management Service (AWS KMS) within the central account, update its key policy to allow cross-account access, and use it to encrypt the S3 bucket.Answer
  2. Configure a Service Control Policy (SCP) that denies public S3 bucket access capabilities, such as configuring public bucket policies or public access blocks, and attach it to the member accounts' Organizational Units (OUs).Answer
  3. C
    Modify the key policy of the default AWS-managed key (`aws/s3`) in the central account to delegate decryption permissions to the member accounts.
  4. D
    Create a Service Control Policy (SCP) that explicitly grants read and write permissions to the central compliance S3 bucket, and attach it to the root Organizational Unit (OU) to enable access for all member accounts.
  5. E
    Create a Route 53 Private Hosted Zone (PHZ) in the central account, configure alias records for the S3 endpoints, and associate the PHZ with the VPCs in the member accounts.

Answer

The solutions architect should create a customer managed KMS key in the central account with a key policy configured for cross-account access, and configure a Service Control Policy to deny S3 public access settings on the member accounts' Organizational Units.
Creating a customer managed KMS key allows editing the key policy to grant cross-account decryption access. Attaching an SCP that denies S3 public access block changes effectively prevents developers in member accounts from bypassing security configurations.

Step-by-Step Solution

1
Analyze the KMS key restriction.
Realize that default AWS-managed keys cannot be shared cross-account because their key policies are unmodifiable.
This establishes the need for a customer managed key.
2
Analyze the restriction on S3 public access.
Realize that Service Control Policies can block actions like configuring public access blocks globally across member OUs.
This enforces organizational compliance rules.
3
Verify correct permissions mechanics for SCPs.
Ensure SCPs are used as guardrails (denying actions) rather than trying to grant positive permissions directly.
SCPs can only restrict permissions, not grant them.

Key Concept

Cross-account KMS sharing and enforcing resource access boundaries with Service Control Policies.
Rate this question

Topics

Strengthening Identity, Access, and Network Security