Examkin

Question

Difficulty: MediumEnhancing Data Protection and Compliance

A media company stores user-generated video assets in an Amazon S3 bucket located in a central archive AWS account. Currently, these assets are encrypted using Amazon S3 managed keys (SSE-S3). To meet new regulatory compliance requirements, the security team mandates that all assets must be encrypted using customer-managed keys (CMKs) with automatic rotation. Furthermore, an encoding application running in a separate production AWS account must be able to read and write these encrypted assets directly. Which of the following actions should a Solutions Architect perform to implement this secure configuration? (Select TWO.)

  1. Create a symmetric customer managed KMS key in the archive account. Modify the key policy to grant the encoding application's IAM role in the production account permissions to perform kms:Decrypt and kms:GenerateDataKey operations, and enable automatic key rotation.Answer
  2. Configure the S3 bucket in the archive account to use default encryption with the newly created customer managed KMS key. Update the bucket policy to grant the encoding application's IAM role in the production account permissions for s3:PutObject and s3:GetObject.Answer
  3. C
    Configure the S3 bucket in the archive account to use the default AWS-managed KMS key for S3 (aws/s3). Modify the key policy in the archive account to allow cross-account access from the production account's IAM role.
  4. D
    Create a Service Control Policy (SCP) at the Organizational Unit (OU) level containing the production account to grant the kms:Decrypt and kms:GenerateDataKey permissions, removing the need for local IAM policy updates.
  5. E
    Configure the S3 bucket policy in the archive account to allow cross-account access, and rely on default S3 bucket encryption behaviors to manage KMS key permissions automatically for the cross-account users.

Answer

Create a symmetric customer managed KMS key in the archive account with cross-account IAM role permissions and automatic key rotation enabled, and configure the archive account's S3 default encryption to use that key while granting s3:PutObject and s3:GetObject permissions in the bucket policy.
To set up secure cross-account S3 access with KMS encryption, a Customer Managed Key (CMK) must be created in the bucket's account (the archive account) because AWS-managed keys cannot be used cross-account. The CMK's key policy must explicitly allow the cross-account IAM role to use the key for decryption and data key generation. Additionally, the S3 bucket's default encryption must be configured to use this CMK, and the S3 bucket policy must allow the production application's IAM role to read and write objects.

Step-by-Step Solution

1
Create and configure a Customer Managed Key (CMK) in the Archive Account.
A symmetric customer managed key is created. Its key policy is configured to delegate key usage permissions to the production account's encoding application IAM role, allowing the cross-account role to generate data keys and decrypt.
AWS-managed keys cannot be shared across accounts or modified. A customer managed key is necessary for cross-account KMS operations.
2
Configure the S3 default bucket encryption and bucket policy in the Archive Account.
The S3 bucket is updated to enforce encryption with the customer managed key. The bucket policy is updated to explicitly allow the production encoding application's IAM role to perform S3 operations.
This enforces data protection compliance for all new uploads and grants the external application access to the physical S3 bucket.

Key Concept

Cross-account KMS key access and default S3 encryption behavior using customer managed keys.
Rate this question

Topics

Enhancing Data Protection and Compliance