Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A media company is designing a secure video processing pipeline. The architecture uses two AWS accounts within an AWS Organization: an Ingestion Account and a Processing Account. Users upload raw video files to an Amazon S3 bucket in the Ingestion Account. An application hosted on Amazon ECS tasks in the Processing Account must read the raw video files, process them, and store the output in a bucket in the Processing Account. All raw video files must be encrypted at rest using AWS KMS. The solution must follow the principle of least privilege. Which combination of configuration steps will allow the ECS application in the Processing Account to read the encrypted raw video files from the Ingestion Account? (Select TWO.)

  1. In the Ingestion Account, update the key policy of a customer managed KMS key to grant the ECS task role in the Processing Account permissions to perform the kms:Decrypt action, and update the Ingestion S3 bucket policy to allow the same task role to perform the s3:GetObject action.Answer
  2. In the Processing Account, attach an IAM policy to the ECS task role that grants permissions to perform the s3:GetObject action on the Ingestion S3 bucket and the kms:Decrypt action on the customer managed KMS key in the Ingestion Account.Answer
  3. C
    In the Ingestion Account, configure default S3 bucket encryption using the AWS managed KMS key (aws/s3) and update the bucket policy to grant the ECS task role in the Processing Account access to the bucket.
  4. D
    In the AWS Organizations management account, apply a Service Control Policy (SCP) to the Organizational Unit containing the Processing Account that explicitly grants the ECS task role the s3:GetObject and kms:Decrypt permissions on the Ingestion Account resources, bypassing the need for local IAM policies.
  5. E
    In the Ingestion Account, create an IAM role with a trust policy allowing SAML 2.0 federation, and configure the ECS tasks in the Processing Account to assume this role using the sts:AssumeRoleWithSAML API call.

Answer

The correct configurations are to update the customer managed KMS key policy and S3 bucket policy in the Ingestion Account to grant access to the ECS task role, and to attach an IAM policy to the ECS task role in the Processing Account allowing s3:GetObject on the bucket and kms:Decrypt on the KMS key.
The correct answer combines updating the resource-based policies (S3 bucket policy and KMS key policy) in the Ingestion Account to delegate trust to the ECS task role, and attaching a matching identity-based IAM policy to the ECS task role in the Processing Account. Because cross-account access requires evaluation of both identity-based policies in the requesting account and resource-based policies in the owning account, both configurations are necessary.

Step-by-Step Solution

1
Ensure that the KMS key in the source account allows cross-account decryption by using a customer managed key instead of an AWS managed key, and update its key policy to trust the ECS task role.
The KMS key policy explicitly permits the ECS task role from the Processing Account to call the kms:Decrypt API.
AWS managed keys cannot be shared cross-account, so a Customer Managed Key (CMK) is required.
2
Grant the destination task role permissions on the source S3 bucket via a resource policy.
The Ingestion S3 bucket policy explicitly allows the ECS task role to execute s3:GetObject.
Cross-account S3 access requires explicit resource-level permission in the host account.
3
Configure the local identity-based permissions for the ECS application.
The ECS task role in the Processing Account contains an IAM policy with s3:GetObject for the remote bucket and kms:Decrypt for the remote KMS key.
Cross-account access requires evaluation and approval from both the trustor (resource-based policy) and the trustee (identity-based policy).

Key Concept

Cross-account S3 bucket access with KMS encryption requires explicit authorization on both the resource policies (S3 bucket and KMS key policies) and the identity-based policy, using a customer managed KMS key.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic