Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

A digital health enterprise is designing a new compliance archiving system on AWS. The application tier runs on Amazon ECS tasks in a Production account (Account 111122223333). These tasks must write daily clinical audit logs to a centralized Amazon S3 bucket located in a dedicated Compliance account (Account 444455556666). The compliance team requires that the S3 bucket be encrypted at rest using AWS KMS, all uploaded objects are fully owned and managed by the Compliance account, and the solution follows the principle of least privilege. Which combination of actions must the Solutions Architect perform to meet these requirements? (Select TWO.)

  1. Configure the S3 bucket in the Compliance account with S3 Object Ownership set to Bucket Owner Enforced, and configure a bucket policy that allows the ECS task role in the Production account to perform s3:PutObject actions.Answer
  2. Create a Customer Managed Key (CMK) in the Compliance account, configure its key policy to allow the ECS task role in the Production account to perform kms:GenerateDataKey and kms:Decrypt actions, and encrypt the S3 bucket using this CMK.Answer
  3. C
    Encrypt the S3 bucket in the Compliance account using the default AWS-managed KMS key for S3 (aws/s3), and configure the ECS task IAM role policy in the Production account to allow access to this key.
  4. D
    Create a Service Control Policy (SCP) that grants the ECS task role permission to write to the Compliance account S3 bucket and use its KMS key, and attach this SCP to the Organizational Unit (OU) containing both accounts.
  5. E
    Configure the S3 bucket policy in the Compliance account to grant s3:PutObject permissions to a wildcard principal (*) restricted by the Organization ID condition, and configure the ECS tasks to upload logs with the bucket-owner-full-control ACL.

Answer

Configure the S3 bucket in the Compliance account with S3 Object Ownership set to Bucket Owner Enforced and configure its bucket policy to allow writes from the Production account's ECS task role; and create a Customer Managed Key (CMK) in the Compliance account with a key policy that delegates KMS usage permissions to the ECS task role.
To safely write cross-account logs, S3 Object Ownership must be configured to Bucket Owner Enforced. This automatically transfers ownership of all written objects to the bucket owner (Compliance account) and disables S3 ACLs, fulfilling the requirement that the Compliance account owns and manages all logs. Additionally, to encrypt cross-account S3 uploads, a Customer Managed Key (CMK) must be created in the Compliance account. The CMK's key policy must be updated to grant usage permissions to the ECS task role in the Production account. The S3 bucket policy must also explicitly allow the ECS task role to perform s3:PutObject.

Step-by-Step Solution

1
Address object ownership requirements by disabling ACLs.
Configuring S3 Object Ownership to 'Bucket Owner Enforced' disables ACLs and automatically transfers ownership of all written objects to the bucket owner's account.
This guarantees that the Compliance account owns and can manage all clinical logs written by the Production account's ECS tasks.
2
Address encryption requirements for cross-account S3 uploads.
Deploying a Customer Managed Key (CMK) in the Compliance account allows editing its key policy to grant the Production account's ECS task role permissions to perform kms:GenerateDataKey and kms:Decrypt.
AWS-managed KMS keys (like aws/s3) cannot be shared cross-account, so a Customer Managed Key must be used.
3
Implement the resource-based access policies.
Allowing the ECS task role in the S3 bucket policy for s3:PutObject enables cross-account log delivery.
Resource-based policies in the destination account must explicitly trust the external IAM principal for cross-account access to succeed.

Key Concept

Cross-account resource access with AWS KMS encryption and S3 Object Ownership controls
Estimated Time:3m 0s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic