An enterprise uses AWS Organizations to manage its multi-account environment. The central IT security team must deploy and configure a third-party security agent on all Amazon EC2 instances, including hybrid managed instances, across multiple member accounts. The installation scripts and configuration files for the agent are stored in a centralized Amazon S3 bucket within a shared services account. The configuration must be enforced daily to remediate any manual modifications, and the configuration files must be encrypted at rest. Which combination of actions must a Solutions Architect take to implement this solution? (Select TWO.)
- Encrypt the centralized S3 bucket using an AWS KMS Customer Managed Key (CMK). Configure the KMS key policy to grant cross-account decrypt permissions to the IAM instance profiles in the member accounts, and configure the S3 bucket policy to allow read access from the member accounts.Answer
- Use AWS CloudFormation StackSets to deploy an AWS Systems Manager (SSM) State Manager association to all member accounts. Configure the association to execute the AWS-RunRemoteScript document on a daily cron schedule to retrieve and run the installation script from the centralized S3 bucket.Answer
- CEncrypt the centralized S3 bucket using the default AWS-managed KMS key for S3. Configure the S3 bucket policy and the member accounts' IAM instance profiles to permit cross-account decrypt operations using this key.
- DAttach a Service Control Policy (SCP) at the root of the AWS Organization that explicitly grants decrypt permissions on the S3 bucket and the KMS key to the EC2 instance roles in all member accounts.
- EDeploy a single AWS Systems Manager (SSM) State Manager association in the shared services account, and configure it to target EC2 instances across all member accounts using Resource Data Sync and resource tags.
Answer
The solutions architect must encrypt the centralized S3 bucket with an AWS KMS Customer Managed Key (CMK) and configure cross-account access on both the S3 bucket and KMS key policies, and then deploy local SSM State Manager associations to member accounts via CloudFormation StackSets to execute the installation script daily.
Automating multi-account configuration deployment and drift correction is best achieved by deploying local SSM State Manager associations to target accounts using CloudFormation StackSets. The association runs locally on a daily schedule to maintain compliance. When accessing configuration files from a central S3 bucket in another account, the bucket must be encrypted with a Customer Managed Key (CMK), and the key policy must grant decryption access to the external instance profiles. This is because default AWS-managed KMS keys do not support policy modifications and cannot be shared cross-account.
Step-by-Step Solution
Key Concept
Cross-account configuration baseline automation using SSM State Manager, CloudFormation StackSets, and cross-account KMS CMK permissions.
Estimated Time:3m 0s