Examkin

Question

Difficulty: MediumEnhancing Data Protection and Compliance

A financial technology company has an existing application running in a production AWS account. The application stores daily payment transaction audit files in an Amazon S3 bucket. Currently, the bucket is configured with default server-side encryption using the AWS managed key (`aws/s3`). For audit compliance, a third-party auditing firm needs to retrieve these files daily from their own AWS account using a dedicated IAM role. A solutions architect must configure the environment to allow this cross-account access while maintaining data protection standards. Which configuration changes will meet these requirements?

  1. Transition the S3 bucket default encryption to a new Customer Managed Key (CMK) in the production account. Configure the KMS key policy of the CMK to grant `kms:Decrypt` and `kms:GenerateDataKey` permissions to the external auditing firm's IAM role, and update the S3 bucket policy in the production account to allow the auditing role read access to the objects.Answer
  2. B
    Configure the default AWS managed key (`aws/s3`) key policy in the production account to grant `kms:Decrypt` permissions to the external auditing firm's IAM role. Modify the S3 bucket policy in the production account to grant read access to the auditing role.
  3. C
    Keep using the AWS managed key (`aws/s3`) for default encryption. Attach a Service Control Policy (SCP) at the Organizational Unit (OU) level of the production account that explicitly grants `kms:Decrypt` and `s3:GetObject` permissions to the external auditing firm's IAM role.
  4. D
    Create a new Customer Managed Key (CMK) in the production account and configure its key policy to grant the external auditing firm's IAM role `kms:Decrypt` and `kms:GenerateDataKey` permissions. Do not modify the S3 bucket policy, relying on the KMS key policy to delegate the cross-account access.

Answer

Transition the S3 bucket default encryption to a new Customer Managed Key (CMK) in the production account, configure the KMS key policy of the CMK to grant permissions to the external auditing firm's IAM role, and update the S3 bucket policy to allow the auditing role read access.
The correct option outlines the required architectural change: transitioning from the immutable AWS managed KMS key to a Customer Managed KMS key (CMK). The key policy of the CMK must explicitly delegate decrypt permissions to the external auditing firm's IAM role, and the S3 bucket policy must also explicitly allow the external role to perform the read actions (`s3:GetObject`). This dual-authorization mechanism is required for cross-account S3 access involving KMS encryption.

Step-by-Step Solution

1
Evaluate the encryption key type used for S3 default encryption.
The current configuration uses the AWS managed key (`aws/s3`), which cannot be shared across accounts because its key policy is immutable.
To support cross-account decryption, the encryption key must be transitioned to a Customer Managed Key (CMK).
2
Create and configure a Customer Managed Key (CMK) in the source production account.
A new CMK is created, and its key policy is modified to grant `kms:Decrypt` and `kms:GenerateDataKey` permissions to the external auditing firm's IAM role principal.
This enables the external role to decrypt the data keys used to encrypt the S3 objects when retrieving them.
3
Modify the S3 bucket policy in the production account.
An S3 bucket policy is attached/updated to grant `s3:GetObject` and related read permissions to the external auditing firm's IAM role.
For cross-account S3 access, the destination account's principal must be explicitly allowed by the source bucket policy.

Key Concept

Cross-account access to S3 buckets encrypted with KMS requires Customer Managed Keys (CMKs) because AWS managed KMS keys cannot be shared cross-account, and access must be granted in both the S3 bucket policy and the KMS key policy.
Rate this question

Topics

Enhancing Data Protection and Compliance