An enterprise is strengthening the security of an existing document management system. The… — AWS Certified Solutions Architect - Professional

An enterprise is strengthening the security of an existing document management system. The system components are distributed as follows:
- On-premises servers in a corporate data center connect to AWS via an AWS Direct Connect connection to an AWS Transit Gateway.
- An application tier runs on Amazon EC2 instances in VPC A (Account A).
- A centralized Amazon S3 bucket containing sensitive PDF files is located in Account B and is encrypted with an AWS KMS key.

Currently, the on-premises servers communicate with the application tier in VPC A via public IP addresses. The application tier accesses the S3 bucket in Account B over the public internet using IAM user access keys stored locally on the EC2 instances.

The solutions architect must implement a security improvement plan that satisfies the following requirements:
- All network traffic between the corporate data center, VPC A, and the S3 bucket must remain within the private network.
- The application tier in VPC A must access the S3 bucket without using long-lived credentials.
- The S3 bucket must only accept requests originating from VPC A or the corporate data center.
- The KMS key must support cross-account access for the application tier in VPC A.

Which combination of actions will meet these requirements in the most secure and operationally efficient manner?

A
Attach an IAM role to the EC2 instances in VPC A. Create a Gateway VPC Endpoint for Amazon S3 in VPC A. Configure Transit Gateway routing to allow the corporate data center to route S3 traffic through the Gateway VPC Endpoint. Encrypt the S3 bucket in Account B using the default AWS managed S3 key (aws/s3). Update the S3 bucket policy in Account B to permit access from the EC2 IAM role, restricted by a condition matching the Gateway VPC Endpoint ID.
B
Attach an IAM role to the EC2 instances in VPC A. Create an Interface VPC Endpoint for Amazon S3 in VPC A. Configure Transit Gateway routing and on-premises DNS to direct S3 traffic through the Interface VPC Endpoint. Encrypt the S3 bucket in Account B using an AWS KMS customer managed key. Attach a Service Control Policy (SCP) to the Organization root that explicitly grants S3 and KMS permissions to the EC2 IAM role, bypassing the need for an S3 bucket policy or key policy update in Account B.
Attach an IAM role to the EC2 instances in VPC A. Create an Interface VPC Endpoint for Amazon S3 in VPC A. Configure Transit Gateway routing and on-premises DNS to direct S3 traffic through the Interface VPC Endpoint. Encrypt the S3 bucket in Account B using an AWS KMS customer managed key. Update the key policy in Account B and the IAM policy in Account A to allow the EC2 IAM role to perform cryptographic operations. Update the S3 bucket policy in Account B to permit access from the EC2 IAM role, restricted by a condition matching the Interface VPC Endpoint ID.Answer
D
Configure a federated IAM role for the EC2 instances in VPC A, but configure the trust policy using the SAML provider as the principal without specifying the EC2 service principal. Create an Interface VPC Endpoint for Amazon S3 in VPC A. Route S3 traffic over the public internet to bypass Direct Connect capacity limits. Encrypt the S3 bucket in Account B using an AWS KMS customer managed key, and update the S3 bucket policy to allow access from the federated role restricted by the source IP range of VPC A.

Answer

The correct solution involves attaching an IAM role to the EC2 instances in VPC A, creating an Interface VPC Endpoint for Amazon S3 in VPC A, routing S3 traffic through this endpoint from both VPC A and the corporate data center over the Transit Gateway, encrypting the S3 bucket with a customer managed key, and updating both the S3 bucket policy and KMS key policy to permit cross-account access from the EC2 IAM role, restricted by the S3 Interface VPC Endpoint ID.

The correct solution resolves the security requirements by replacing long-lived credentials with an IAM role (instance profile) attached to the EC2 instances. It routes all S3 traffic privately using an Interface VPC Endpoint (PrivateLink) in VPC A. Unlike Gateway VPC Endpoints, Interface VPC Endpoints support routing from on-premises environments over Direct Connect and Transit Gateway. To support cross-account access, a Customer Managed Key (CMK) is used because AWS-managed keys (aws/s3) cannot be shared across accounts. Finally, the S3 bucket policy in Account B permits access to the IAM role in Account A only when the request originates from the S3 Interface VPC Endpoint, securing both VPC A and on-premises traffic.

Step-by-Step Solution

Configure identity-based access without long-lived credentials

Attach an IAM role (instance profile) to the EC2 instances in VPC A, allowing them to make API calls to S3 and KMS.

This removes the requirement for storing hardcoded, long-lived AWS access keys on the EC2 instances.

Establish a private network path for S3 access from both environments

Create an Interface VPC Endpoint (PrivateLink) for S3 in VPC A. Configure corporate DNS and Transit Gateway routing to direct S3 requests from both VPC A and on-premises to this endpoint.

Interface VPC Endpoints are assigned private IPs from the VPC subnet, making them accessible from on-premises via Direct Connect, unlike Gateway VPC Endpoints.

Enable cross-account encryption key access

Use an AWS KMS customer managed key (CMK) to encrypt the S3 bucket in Account B. Modify the key policy to grant the Account A EC2 IAM role permissions for decrypting and generating data keys.

AWS-managed keys (aws/s3) cannot be shared cross-account because their policies are immutable. A customer managed key must be used for cross-account KMS operations.

Enforce bucket access boundaries and authorization

Apply a bucket policy to the S3 bucket in Account B that permits access to the EC2 IAM role in Account A only when the request originates from the specified Interface VPC Endpoint ID (using the aws:sourceVpce condition).

This guarantees that access is limited to authorized compute resources in VPC A and on-premises servers routing through that specific endpoint.

Key Concept

Strengthening cross-account and hybrid access security requires combining IAM roles, customer managed KMS keys, Interface VPC Endpoints for transitive routing, and bucket policies using condition keys (aws:sourceVpce).

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics