Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

An IoT service provider is designing a new multi-tenant telemetry ingestion platform on AWS. The core ingestion application runs on Amazon ECS in a shared services AWS account (Account A) and must write incoming telemetry data directly to Amazon S3 buckets located in various customer-owned AWS accounts. A key requirement is that a retail customer (using Account B) must control the encryption keys used for their data at rest and have the ability to immediately revoke the ingestion application's write access to their bucket without modifying any S3 bucket policies. Which of the following configuration strategies meets these security and architectural requirements?

  1. A
    Configure the S3 bucket in Account B to use default Server-Side Encryption with AWS KMS (SSE-KMS) utilizing the AWS managed key for S3 (aws/s3) in Account B. Configure the S3 bucket policy in Account B to grant s3:PutObject permissions to the ingestion IAM role from Account A. In Account A, attach an IAM policy to the ingestion role that allows s3:PutObject on Account B's bucket and kms:GenerateDataKey on the aws/s3 key in Account B.
  2. B
    Create a Customer Managed Key in Account B. Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account B that explicitly allows s3:PutObject and kms:GenerateDataKey actions for the principal of the ingestion IAM role in Account A. Rely on this SCP to grant the cross-account permissions and enable write access, allowing the customer to revoke access by detaching the SCP.
  3. Configure the S3 bucket in Account B to use default Server-Side Encryption with AWS KMS (SSE-KMS) utilizing a Customer Managed Key (CMK) created in Account B. Update the CMK key policy in Account B to grant kms:GenerateDataKey permissions to the ingestion IAM role from Account A. Configure the S3 bucket policy in Account B to grant s3:PutObject permissions to the ingestion IAM role. In Account A, attach an IAM policy to the ingestion role that allows s3:PutObject on Account B's bucket and kms:GenerateDataKey on Account B's CMK.Answer
  4. D
    Create a Customer Managed Key in Account B and configure its key policy to grant the ingestion IAM role in Account A the kms:GenerateDataKey permission. Configure the S3 bucket policy in Account B to restrict access using organizational conditions (aws:PrincipalOrgID) to trust Account A's organization, but omit the specific ingestion IAM role principal from the S3 bucket policy statements, relying on the organizational condition to permit the write access.

Answer

Configure the S3 bucket in Account B to use a Customer Managed Key (CMK), grant the ingestion role in Account A both s3:PutObject and kms:GenerateDataKey permissions via Account B's resource policies, and configure corresponding IAM policies in Account A to permit these actions.
The correct strategy involves configuring the S3 bucket in the customer's account (Account B) to encrypt data using a Customer Managed Key (CMK). By granting the ingestion IAM role in Account A permission to generate data keys on Account B's CMK, and granting write access via the S3 bucket policy, the ingestion role is authorized to perform cross-account writes. The customer can immediately revoke access by disabling the CMK or changing the key policy, which blocks key generation and halts S3 uploads without needing to modify S3 bucket policies.

Step-by-Step Solution

1
Determine the encryption key type required for cross-account S3 write operations.
Identify that a Customer Managed Key (CMK) in Account B is required.
AWS managed keys (like aws/s3) cannot be shared cross-account because their key policies are immutable and cannot grant access to external accounts.
2
Configure permissions in the destination account (Account B).
Grant the ingestion IAM role from Account A permissions to call s3:PutObject in the S3 bucket policy, and kms:GenerateDataKey in the Customer Managed Key policy.
Cross-account resource access requires explicit resource-level permission delegation from the owning account.
3
Configure local IAM permissions in the source account (Account A).
Attach an IAM policy to the ingestion role allowing s3:PutObject on Account B's bucket and kms:GenerateDataKey on Account B's CMK.
An IAM entity in one account must be explicitly permitted by its own account's policies to perform cross-account resource operations.
4
Verify key revocation requirements.
Disable the CMK or remove the ingestion role from the key policy to revoke access immediately.
S3 SSE-KMS requires the calling principal to successfully call kms:GenerateDataKey to encrypt the object. Revoking KMS access halts S3 uploads immediately without needing to modify the S3 bucket policy.

Key Concept

Cross-account KMS and S3 permissions delegation
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic