Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

A financial service provider is designing a new compliance auditing application. The application runs on Amazon EC2 instances inside a private VPC in a Production Account. The application retrieves database credentials from AWS Secrets Manager to decrypt transaction logs. To meet regulatory compliance, the Solutions Architect must implement the following controls:
1. Prevent data exfiltration by ensuring that requests to AWS Secrets Manager from the private VPC can only access Secrets Manager secrets belonging to the company's AWS Organization.
2. Restrict access to the secrets so that only requests originating from the private VPC's endpoint are permitted, blocking any public internet access.
3. Encrypt the secrets at rest using a custom key that allows secure cross-account decryption by auditors in a separate Audit Account.

Which TWO configurations must the Solutions Architect implement to meet these security requirements? (Select TWO.)

  1. Deploy an interface VPC endpoint for AWS Secrets Manager in the Production VPC, and attach an endpoint policy that allows access only to secrets where the aws:ResourceOrgID condition key matches the company's AWS Organization ID.Answer
  2. Attach a resource-based policy to each Secrets Manager secret that denies all access to the secret if the aws:sourceVpce condition key does not match the ID of the Production VPC endpoint.Answer
  3. C
    Encrypt the secrets using the default AWS-managed KMS key aws/secretsmanager, and modify its key policy to grant decryption permissions to the IAM roles in the Audit Account.
  4. D
    Attach a Service Control Policy (SCP) to the Production Account's Organizational Unit that grants the EC2 instance role permission to retrieve secrets, which overrides any local IAM policy or resource policy denies.
  5. E
    Configure a centralized S3 bucket in the Audit Account to receive CloudTrail logs from the Production Account, using a bucket policy that grants s3:PutObject access to the Production Account's IAM root ARN while omitting the CloudTrail service principal (cloudtrail.amazonaws.com) in the Principal element.

Answer

To meet the security and compliance requirements, the Solutions Architect must deploy an interface VPC endpoint for AWS Secrets Manager in the Production VPC with an endpoint policy that restricts access to the company's AWS Organization using the aws:ResourceOrgID condition key, and attach a resource-based policy to each secret that denies access if the request does not originate from the Production VPC endpoint (using the aws:sourceVpce condition key).
The correct configurations involve using an interface VPC endpoint for AWS Secrets Manager combined with a VPC endpoint policy using the aws:ResourceOrgID condition key to restrict outgoing VPC traffic to the company's AWS Organization, preventing exfiltration to outside accounts. Additionally, attaching a resource-based policy to each secret that denies access when aws:sourceVpce does not match the VPC endpoint ID restricts access exclusively to that private endpoint, blocking external access.

Step-by-Step Solution

1
Implement data perimeter controls on the VPC endpoint.
An interface VPC endpoint is deployed, and its policy is configured with aws:ResourceOrgID to restrict outbound Secrets Manager requests to the company's organization only.
This prevents data exfiltration by blocking access to secrets hosted in external or personal AWS accounts.
2
Restrict secret access to the VPC endpoint.
A resource-based policy is attached to each secret using a Deny effect with StringNotEquals for aws:sourceVpce pointing to the VPC endpoint.
This ensures that the secrets can only be accessed through the private VPC endpoint, blocking public access.
3
Establish cross-account decryption for auditing.
A Customer Managed Key (CMK) is used to encrypt the secrets, with its key policy configured to delegate decryption permissions to the Audit Account.
AWS-managed keys cannot be shared cross-account or have their policies modified, so a Customer Managed Key is required.

Key Concept

Data perimeter design using VPC endpoint policies, resource-based policies, and cross-account Customer Managed Key sharing.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic