A retail company, ShopNova Retail, is designing a new compliance reporting system. Application servers running in the Production Account (Account A) under an IAM role need to write encrypted compliance reports to an Amazon S3 bucket located in the centralized Compliance Account (Account B). The compliance team requires that all data at rest be encrypted using a Customer Managed Key (CMK) in AWS KMS that they can manage and rotate. Which configuration strategy will meet these requirements while following the principle of least privilege?
- In Account B, create a Customer Managed Key (CMK) and configure its key policy to allow the IAM role in Account A to perform the kms:GenerateDataKey action. In the S3 bucket policy in Account B, grant the IAM role in Account A the s3:PutObject permission. In Account A, attach an IAM policy to the IAM role that allows the s3:PutObject action on the S3 bucket in Account B and the kms:GenerateDataKey action on the CMK in Account B.Answer
- BIn Account B, configure the S3 bucket to use the default AWS managed key (aws/s3) for encryption at rest. In the S3 bucket policy in Account B, grant the IAM role in Account A the s3:PutObject permission. In Account A, attach an IAM policy to the IAM role that allows the s3:PutObject action on the S3 bucket in Account B and the kms:GenerateDataKey action on the AWS managed key in Account B.
- CIn Account B, create a Customer Managed Key (CMK) and configure the S3 bucket to use it. Create a Service Control Policy (SCP) at the organization root level that explicitly allows the s3:PutObject and kms:GenerateDataKey actions for the IAM role in Account A, relying on the SCP to grant cross-account permissions without modifying the S3 bucket policy or the KMS key policy in Account B.
- DIn Account B, create a Customer Managed Key (CMK) and configure its key policy to allow the IAM role in Account A to perform the kms:GenerateDataKey action. In the S3 bucket policy in Account B, omit the explicit cross-account Principal declaration for Account A's IAM role, and rely on Account A's local IAM policy to authorize the s3:PutObject action on the S3 bucket.
Answer
In Account B, create a Customer Managed Key (CMK) and configure its key policy to allow the IAM role in Account A to perform the kms:GenerateDataKey action. In the S3 bucket policy in Account B, grant the IAM role in Account A the s3:PutObject permission. In Account A, attach an IAM policy to the IAM role that allows the s3:PutObject action on the S3 bucket in Account B and the kms:GenerateDataKey action on the CMK in Account B.
The correct solution correctly defines both local IAM permissions in the source account and resource-based policies in the destination account. Cross-account access requires explicit permission in both the IAM policy of the source account and the S3 bucket and KMS key policies of the destination account. Furthermore, using a Customer Managed Key is required because AWS managed keys do not support policy modification and cannot be accessed cross-account.
Step-by-Step Solution
Key Concept
Cross-account access in AWS requires explicit delegation on both the resource side (bucket policy and key policy) and the caller side (IAM policy), using a Customer Managed Key since AWS managed keys cannot be shared cross-account.