Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

A European Union public sector agency is designing a secure document archiving solution across a multi-account organization. The architecture includes a centralized Archive Account (account 111122223333) with an Amazon S3 bucket, and multiple departmental Agency Accounts. Applications in the Agency Accounts run on Amazon EC2 instances and must upload official records directly to the centralized S3 bucket.

To meet strict data sovereignty compliance, all uploaded objects must be encrypted using server-side encryption with AWS KMS (SSE-KMS) using a key managed by the security team in the Archive Account. The security team wants to ensure that:
1. Departmental applications can upload files only if they are encrypted with the approved key.
2. The Archive Account retains full control over the encryption key and the data.
3. The departmental applications cannot delete or modify archives once uploaded.

The security team creates a Customer Managed Key (CMK) in the Archive Account. How should the security team configure the policies to allow the Agency Account (account 444455556666) applications to upload encrypted documents to the S3 bucket?

  1. A
    Configure the S3 bucket in the Archive Account to use the default AWS-managed key `aws/s3` for server-side encryption. In the Archive Account's S3 bucket policy, grant the Agency Account's IAM role (`AgencyUploadRole`) permissions for the `s3:PutObject` action. In the Agency Account, attach an IAM policy to the `AgencyUploadRole` that permits `s3:PutObject` on the S3 bucket and `kms:GenerateDataKey` on the `aws/s3` key resource.
  2. B
    Create a Customer Managed Key (CMK) in the Archive Account and retain the default key policy. Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing both accounts that explicitly allows the `s3:PutObject`, `kms:GenerateDataKey`, and `kms:Decrypt` actions for all principals, assuming this grants the cross-account access without modifying the individual KMS key policy or local IAM roles.
  3. Create a Customer Managed Key (CMK) in the Archive Account. In the CMK's key policy, grant the Agency Account's IAM role (`AgencyUploadRole`) permissions for the `kms:GenerateDataKey` and `kms:Decrypt` actions. In the Archive Account's S3 bucket policy, grant the `AgencyUploadRole` permissions for the `s3:PutObject` action, with conditions enforcing encryption using the CMK. In the Agency Account, attach an IAM policy to the `AgencyUploadRole` that permits `s3:PutObject` on the S3 bucket and `kms:GenerateDataKey` and `kms:Decrypt` on the CMK.Answer
  4. D
    Create a Customer Managed Key (CMK) in the Archive Account. In the CMK's key policy, grant the Agency Account's root user principal (`arn:aws:iam::444455556666:root`) permissions for the `kms:GenerateDataKey` and `kms:Decrypt` actions. In the Archive Account's S3 bucket policy, grant the Agency Account's root user principal permissions for the `s3:PutObject` action. Rely on this cross-account trust configuration alone and do not attach any local IAM policies to the `AgencyUploadRole` in the Agency Account.

Answer

Create a Customer Managed Key (CMK) in the Archive Account. In the CMK's key policy, grant the Agency Account's IAM role (`AgencyUploadRole`) permissions for the `kms:GenerateDataKey` and `kms:Decrypt` actions. In the Archive Account's S3 bucket policy, grant the `AgencyUploadRole` permissions for the `s3:PutObject` action, with conditions enforcing encryption using the CMK. In the Agency Account, attach an IAM policy to the `AgencyUploadRole` that permits `s3:PutObject` on the S3 bucket and `kms:GenerateDataKey` and `kms:Decrypt` on the CMK.
The correct solution involves creating a Customer Managed Key (CMK) in the Archive Account, which allows key policy customization. For cross-account access to work with encrypted S3 buckets, permissions must be explicitly allowed at three layers: the KMS key policy, the S3 bucket policy, and the IAM policy of the source role. The key policy and bucket policy in the Archive Account must trust the external role principal (or trust the root account and have the root account delegate it), and the IAM policy in the Agency Account must grant the role the permission to use the external S3 bucket and CMK.

Step-by-Step Solution

1
Evaluate the key type requirements for cross-account encryption and decryption.
Identify that AWS-managed KMS keys (like `aws/s3`) cannot be used for cross-account uploads because their key policies are fixed and cannot be modified. A Customer Managed Key (CMK) must be created in the destination account (Archive Account) to enable policy customization.
AWS-managed keys do not support cross-account sharing.
2
Configure permissions on the resource policies in the destination account (Archive Account).
Modify the KMS key policy to permit the external IAM role (`AgencyUploadRole`) to perform `kms:GenerateDataKey` and `kms:Decrypt`. Modify the S3 bucket policy to permit the external IAM role to perform `s3:PutObject` with conditions requiring SSE-KMS with the specific CMK.
Resource-based policies must trust the external account or role for cross-account access.
3
Configure the local IAM policy in the source account (Agency Account).
Attach an IAM policy to the `AgencyUploadRole` that explicitly allows `s3:PutObject` on the destination S3 bucket and `kms:GenerateDataKey` and `kms:Decrypt` on the CMK in the Archive Account.
Even if the target resource policies trust the external principal or account, the source account must still explicitly grant its own roles permission to perform the cross-account actions.

Key Concept

Cross-account access to encrypted S3 buckets requires configuring permissions on the destination resource policies (S3 bucket policy and KMS key policy) and the source account's IAM policies, utilizing a Customer Managed Key (CMK) rather than an AWS-managed key.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic