Examkin

Question

Difficulty: Very hardSecurity and Compliance Control Design

A multinational retail corporation is designing a secure vendor inventory ingestion platform. Vendors must upload inventory catalogs from their respective AWS accounts directly to an Amazon S3 bucket located in the retailer's central Ingestion account. The retailer's security policy mandates that all data must be encrypted at rest using AWS KMS. The solutions architect initially configures default S3 bucket encryption using the AWS-managed S3 key (aws/s3). However, vendor IAM roles receive 'Access Denied' errors when attempting to upload objects, despite having explicit s3:PutObject permissions in their IAM policies and the S3 bucket policy. Which configuration change will resolve this issue while maintaining compliance with the security policy?

  1. Replace the default S3 bucket encryption with a Customer Managed Key (CMK) created in the Ingestion account. Configure the CMK's key policy to allow the vendor's IAM roles to perform the kms:GenerateDataKey and kms:Encrypt actions, and add corresponding permissions to the vendor roles' local IAM policies.Answer
  2. B
    Retain the default S3 bucket encryption using the AWS-managed KMS key (aws/s3). Update the Ingestion S3 bucket policy to allow the vendor IAM roles to perform the kms:GenerateDataKey and kms:Encrypt actions directly on the bucket, which delegates access to the underlying AWS-managed key.
  3. C
    Apply a Service Control Policy (SCP) at the root of the retailer's AWS Organization that permits the kms:GenerateDataKey and kms:Encrypt actions on the default aws/s3 key for the vendor accounts. Attach this SCP to the OU containing the Ingestion account to enable cross-account access.
  4. D
    Modify the trust relationship of a cross-account IAM role in the Ingestion account to trust the vendor's AWS accounts. Configure the S3 bucket policy with an aws:PrincipalOrgID condition referencing the vendor's Organization ID to allow direct S3 uploads without KMS key policy changes.

Answer

Replace the default S3 bucket encryption with a Customer Managed Key (CMK) created in the Ingestion account, configure the CMK's key policy to allow the vendor's IAM roles to perform the kms:GenerateDataKey and kms:Encrypt actions, and add corresponding permissions to the vendor roles' local IAM policies.
The correct solution is to use a Customer Managed Key (CMK) because AWS-managed keys (such as aws/s3) cannot be shared across accounts. Their key policies are managed by AWS, cannot be modified, and do not permit cross-account usage. By replacing the default encryption with a CMK in the target account, the retailer can modify its key policy to explicitly trust the vendor's IAM roles. The vendor's IAM roles must also be granted permission to perform kms:GenerateDataKey and kms:Encrypt in their local IAM policies to allow the cross-account KMS operations.

Step-by-Step Solution

1
Identify the root cause of the cross-account upload failure.
The S3 bucket is configured with default encryption using the AWS-managed KMS key (aws/s3). AWS-managed keys cannot be shared across accounts because their key policies cannot be modified.
Understanding why the initial setup fails is necessary to rule out suggestions that attempt to reuse the AWS-managed key.
2
Select the correct KMS key type for cross-account S3 bucket uploads.
A Customer Managed Key (CMK) must be created in the destination (retailer's) account.
Only Customer Managed Keys support custom key policies that can be configured to grant access to external accounts or roles.
3
Configure permissions on the resource side.
Modify the CMK's key policy to allow the vendor's IAM roles the permissions to call kms:GenerateDataKey and kms:Encrypt.
For cross-account access, the resource policy (key policy) must explicitly authorize the external principal.
4
Configure permissions on the identity side.
Ensure the vendor's IAM policies grant the roles permissions to call kms:GenerateDataKey and kms:Encrypt on the CMK's ARN.
Cross-account authorization requires permission checks to pass on both the resource policy and the caller's identity policy.

Key Concept

Cross-account KMS key sharing and policy requirements for default S3 bucket encryption.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic