Examkin

Question

Difficulty: HardAutomating Deployment and Configuration Management

An enterprise utilizes a multi-account AWS environment managed via AWS Organizations. A central DevOps team maintains a continuous delivery pipeline in a Tooling account using AWS CodePipeline. The pipeline orchestrates the deployment of a microservices application to Amazon ECS (Fargate) in a separate Production account. The pipeline packages deployment artifacts and writes them to an Amazon S3 bucket in the Tooling account, encrypted using the default AWS-managed KMS key (aws/s3).

During a release, the CodePipeline execution fails at the CodeDeploy stage in the Production account with an Access Denied error when trying to retrieve the deployment package from the Tooling account's S3 bucket. A solutions architect must resolve this issue while maintaining the automated deployment process and enforcing the principle of least privilege.

Which of the following actions should the solutions architect take to resolve the deployment failure?

  1. Create a customer managed key (CMK) in the Tooling account. Configure the S3 bucket to use this CMK for encryption. Update the CMK key policy in the Tooling account to grant kms:Decrypt and kms:GenerateDataKey permissions to the IAM role assumed by CodeDeploy in the Production account. Configure the S3 bucket policy to allow read access from the Production account's CodeDeploy role.Answer
  2. B
    Modify the key policy of the existing AWS-managed KMS key (aws/s3) in the Tooling account to grant cross-account kms:Decrypt and kms:GenerateDataKey permissions to the IAM role assumed by CodeDeploy in the Production account. Attach an IAM policy to the CodeDeploy role in the Production account permitting read access to the S3 bucket.
  3. C
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the Production account that explicitly permits kms:Decrypt and kms:GenerateDataKey on the Tooling account's S3 bucket and default AWS-managed key (aws/s3) for the CodeDeploy IAM role.
  4. D
    Instruct an operator to manually download the deployment artifacts from the Tooling account S3 bucket, upload them to a local S3 bucket in the Production account, and manually update the CloudFormation stack in the Production account. Then, modify the pipeline to bypass artifact retrieval by disabling CloudFormation drift detection.

Answer

Create a customer managed key (CMK) in the Tooling account, use it for encrypting the S3 bucket, and grant cross-account decrypt permissions in the CMK policy and S3 bucket policy to the target account's CodeDeploy role.
The correct answer is correct because cross-account access to S3 objects encrypted with KMS requires a Customer Managed Key (CMK). AWS-managed keys (like aws/s3) cannot be shared across accounts because their key policies are managed by AWS and cannot be modified. Additionally, cross-account access requires explicit permission in both the KMS key policy and the S3 bucket policy, alongside the IAM permissions attached to the role in the destination account.

Step-by-Step Solution

1
Identify the cause of the cross-account S3 and KMS decryption failure.
AWS-managed keys (such as the default aws/s3 key) cannot be shared across accounts because their key policies cannot be customized to grant access to external principals.
This is a fundamental security limitation of AWS-managed KMS keys.
2
Replace the encryption mechanism with a Customer Managed Key (CMK).
Create a new CMK in the Tooling account, configure S3 to use it, and update the CMK policy to trust the Production account's IAM role for decryption.
CMKs allow custom key policies, enabling multi-account access control.
3
Configure S3 bucket policy and destination IAM permissions.
Update the Tooling account S3 bucket policy to allow read access to the Production account's CodeDeploy role, and ensure the Production role has permissions to read the S3 bucket and decrypt using the Tooling account's KMS CMK.
Cross-account access requires authorization on both the resource (S3 bucket policy) and the key (KMS key policy), as well as the client identity (IAM policy).

Key Concept

Cross-account resource access with KMS encryption requires Customer Managed Keys (CMKs) and matching resource/identity policies.
Estimated Time:2m 30s
Rate this question

Topics

Automating Deployment and Configuration Management