Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

An enterprise is designing a secure centralized log collection system. Application servers running on Amazon EC2 instances in a Production account (111122223333111122223333) must write transaction logs directly to an Amazon S3 bucket located in a central Security account (444455556666444455556666). The solutions architect must enforce the following security and compliance controls:

- Data Encryption: All log objects uploaded to the S3 bucket must be encrypted at rest using an AWS KMS key that supports automatic annual rotation.
- Access Control: The EC2 instance IAM role in the Production account must have permission to write objects to the S3 bucket and encrypt them, but must be prevented from reading, downloading, or decrypting any objects stored in the bucket.
- Data Loss Prevention: No users or roles within the AWS Organization, including administrators, are allowed to delete objects in the S3 bucket, with the sole exception of a central `SecurityAuditRole` in the Security account.

Which combination of configuration steps will satisfy these compliance requirements?

  1. A
    Configure the S3 bucket in the Security account to use the default AWS-managed KMS key (`aws/s3`) for encryption. In the S3 bucket policy in the Security account, allow `s3:PutObject` from the Production EC2 role. Attach an SCP to the Organization root that denies `s3:DeleteObject*` with a condition block specifying `"ArnNotEquals": {"aws:PrincipalArn": "arn:aws:iam::444455556666:role/SecurityAuditRole"}`.
  2. B
    Create a Customer Managed Key (CMK) in the Security account with automatic key rotation enabled. Attach an SCP to the OUs containing the Production and Security accounts that allows `s3:PutObject` and `kms:GenerateDataKey` actions from the Production EC2 role to the Security account S3 bucket and CMK. Deny `s3:DeleteObject*` in the SCP with a condition block specifying `"ArnNotEquals": {"aws:PrincipalArn": "arn:aws:iam::444455556666:role/SecurityAuditRole"}`.
  3. Create a Customer Managed Key (CMK) in the Security account with automatic key rotation enabled. In the CMK key policy, grant the Production EC2 role permissions for `kms:GenerateDataKey`. In the S3 bucket policy in the Security account, allow `s3:PutObject` from the Production EC2 role. Attach an SCP to the Organization root that denies `s3:DeleteObject*` with a condition block specifying `"ArnNotEquals": {"aws:PrincipalArn": "arn:aws:iam::444455556666:role/SecurityAuditRole"}`.Answer
  4. D
    Create a Customer Managed Key (CMK) in the Security account with automatic key rotation enabled. In the CMK key policy, grant the Production EC2 role permissions for `kms:GenerateDataKey`. Configure the S3 bucket policy in the Security account using a wildcard principal (`"Principal": "*"`) with an `"aws:PrincipalOrgID"` condition to allow write access, and omit the specific Production EC2 role ARN. Attach an SCP to the Organization root that denies `s3:DeleteObject*` with a condition block specifying `"ArnNotEquals": {"aws:PrincipalArn": "arn:aws:iam::444455556666:role/SecurityAuditRole"}`.

Answer

Create a Customer Managed Key (CMK) in the Security account with automatic key rotation enabled, allowing the Production EC2 role only `kms:GenerateDataKey` permissions. Set the S3 bucket policy to allow the Production EC2 role `s3:PutObject` access, and deny deletion using an Organization-wide Service Control Policy (SCP) that exempts the central audit role.
The correct solution uses a Customer Managed Key (CMK) in the Security account with key rotation enabled, allowing the Production EC2 role to perform `kms:GenerateDataKey` (which allows encryption during upload) but withholding `kms:Decrypt` permissions. The S3 bucket policy explicitly allows the Production EC2 role to perform `s3:PutObject`. Finally, the SCP uses an `ArnNotEquals` condition to deny deletion for all users except the designated security audit role.

Step-by-Step Solution

1
Select the correct KMS key type for cross-account encryption.
Choose a Customer Managed Key (CMK) in the Security account instead of an AWS-managed key.
AWS-managed KMS keys (like `aws/s3`) cannot have their key policies modified and cannot be shared across accounts.
2
Configure the CMK key policy in the Security account.
Grant the Production EC2 role `kms:GenerateDataKey` but do not grant `kms:Decrypt`.
This allows the application to encrypt logs during upload but prevents it from reading or decrypting any existing logs.
3
Configure the S3 bucket policy in the Security account.
Explicitly allow the Production EC2 role ARN to perform `s3:PutObject`.
Cross-account S3 access requires explicit permissions in the resource-based policy of the receiving account.
4
Implement the data loss prevention control at the Organization level.
Create an SCP denying `s3:DeleteObject*` actions, with a condition block that excludes the `SecurityAuditRole` using `ArnNotEquals` against `aws:PrincipalArn`.
SCPs apply to all member accounts (including administrators) and are the correct way to enforce organization-wide boundaries.

Key Concept

Cross-account resource access control using resource-based policies combined with KMS Customer Managed Keys and Service Control Policies.
Estimated Time:3m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic