Examkin

Question

Difficulty: MediumStrengthening Identity, Access, and Network Security

An enterprise runs an application on Amazon EC2 instances in a private subnet within VPC A in Account A. The application must retrieve sensitive files from an Amazon S3 bucket in Account B. The S3 bucket is encrypted using a Customer Managed Key (CMK) in Account B. VPC A has no internet gateway, NAT gateway, or virtual private gateway configured. All traffic must remain within the AWS network, and the solution must enforce least-privilege security.

Which two actions should a Solutions Architect take to configure this connection? (Select two.)

  1. Create an S3 Gateway VPC Endpoint and a KMS Interface VPC Endpoint in VPC A, and associate the S3 gateway endpoint with the VPC A route tables.Answer
  2. Configure the KMS key policy of the Customer Managed Key in Account B to allow the application's IAM role in Account A to perform kms:Decrypt operations.Answer
  3. C
    Configure the S3 bucket to use the AWS-managed key (aws/s3) in Account B, and update the application's IAM policy in Account A to allow decryption using this key.
  4. D
    Establish a VPC Peering connection between VPC A and a VPC in Account B, and route S3 traffic from VPC A through a Gateway VPC Endpoint deployed in Account B's VPC.
  5. E
    Attach a Service Control Policy (SCP) to the Organization root that grants the application's IAM role in Account A permissions to perform s3:GetObject and kms:Decrypt on resources in Account B.

Answer

Create an S3 Gateway VPC Endpoint and a KMS Interface VPC Endpoint in VPC A, and configure the KMS key policy of the Customer Managed Key in Account B to trust the cross-account IAM role.
The correct solution involves setting up both S3 and KMS VPC endpoints in VPC A to ensure the network traffic remains private. S3 traffic goes through the gateway endpoint, and KMS decryption calls go through the KMS interface endpoint. For access, since the S3 objects are encrypted with a Customer Managed Key, the key policy in Account B must be updated to grant decryption rights to the cross-account IAM role in Account A.

Step-by-Step Solution

1
Configure private network routing to S3 and KMS in VPC A.
Create an S3 Gateway VPC Endpoint and associate it with VPC A's route tables to route S3 traffic privately. Create a KMS Interface VPC Endpoint (PrivateLink) in VPC A to allow the application to privately make kms:Decrypt API calls without internet routing.
Since the VPC has no internet or NAT gateway, all AWS API endpoints must be reached using VPC endpoints. Gateway endpoints are used for S3, while Interface endpoints are used for KMS.
2
Configure the cross-account KMS key policy.
Update the Customer Managed Key (CMK) key policy in Account B to grant the IAM role from Account A permissions for the kms:Decrypt action.
To read objects encrypted with SSE-KMS, the caller must have decrypt permissions. Because this is a cross-account scenario, a Customer Managed Key must be used, and its key policy must explicitly trust the external IAM role.
3
Configure cross-account S3 permissions.
Ensure the S3 bucket policy in Account B allows the IAM role in Account A to read the objects.
Cross-account access to S3 requires permissions to be granted both in the caller's IAM policy and the target bucket's policy.

Key Concept

Cross-account access to encrypted S3 resources from a private VPC requires a local S3 Gateway VPC Endpoint, a local KMS Interface VPC Endpoint, and explicit permission grants in both the S3 bucket policy and the KMS Customer Managed Key policy.
Rate this question

Topics

Strengthening Identity, Access, and Network Security