Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

Aria BioPharma is designing a secure compliance monitoring platform. In the Shared Services account (Account 111111111111111111111111), a build pipeline generates custom Amazon Machine Images (AMIs) containing proprietary security auditing software. The root EBS volumes of these AMIs are encrypted using an AWS KMS Customer Managed Key (CMK) located in the Shared Services account. To deploy these AMIs, the solutions architect must configure an Auto Scaling group in the Production account (Account 222222222222222222222222) to launch EC2 instances from the shared AMIs. Which of the following configurations will allow the Auto Scaling group in the Production account to successfully launch the instances while maintaining the principle of least privilege?

  1. Share the custom AMI with Account 222222222222222222222222. In Account 111111111111111111111111, modify the KMS key policy to grant the Auto Scaling service-linked role in Account 222222222222222222222222 (arn:aws:iam::222222222222:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling) permissions to kms:Decrypt, kms:DescribeKey, and kms:CreateGrant.Answer
  2. B
    Encrypt the AMI root volumes using the default AWS-managed KMS key for Amazon EBS (aws/ebs) in Account 111111111111111111111111. Modify the key policy of this AWS-managed key to grant Account 222222222222222222222222 cross-account decrypt access, and share the AMI with Account 222222222222222222222222.
  3. C
    Share the custom AMI with Account 222222222222222222222222. Attach a Service Control Policy (SCP) to the Organizational Unit containing Account 222222222222222222222222 that explicitly allows the autoscaling.amazonaws.com service principal to perform kms:Decrypt and kms:CreateGrant actions on the KMS key in Account 111111111111111111111111.
  4. D
    Share the custom AMI with Account 222222222222222222222222. Configure a SAML 2.0 federated role in Account 111111111111111111111111 that trusts Account 222222222222222222222222. Configure the Auto Scaling group in Account 222222222222222222222222 to assume this federated role using sts:AssumeRoleWithSAML to access the KMS key.

Answer

Sharing the custom AMI with the Production account and modifying the KMS key policy in the Shared Services account to grant the Production account's Auto Scaling service-linked role kms:Decrypt, kms:DescribeKey, and kms:CreateGrant permissions.
To deploy an instance from an encrypted AMI in another account using an Auto Scaling group, the source account must share the AMI and update its Customer Managed Key (CMK) policy. The key policy must grant the target account's Auto Scaling service-linked role (AWSServiceRoleForAutoScaling) the kms:Decrypt, kms:DescribeKey, and kms:CreateGrant permissions. The kms:CreateGrant permission is critical because it allows Auto Scaling to create a grant on the key, delegating decryption permissions to the Amazon EC2 service which mounts the volume.

Step-by-Step Solution

1
Share the custom AMI from the Shared Services account with the Production account.
The Production account gains access to reference the shared AMI in its launch templates or launch configurations.
AMI sharing makes the AMI metadata and snapshot permissions available to the target account.
2
Add the Auto Scaling service-linked role of the Production account as a principal in the key policy of the Customer Managed Key (CMK) in the Shared Services account.
The external service-linked role is trusted to use the CMK.
For cross-account access to KMS keys, the key policy in the owning account must explicitly allow the external principal.
3
Grant the service-linked role permissions for kms:Decrypt, kms:DescribeKey, and kms:CreateGrant.
The Auto Scaling service-linked role can decrypt the encrypted volume and delegate the decryption to the EC2 service.
Auto Scaling uses cryptographic grants to delegate decryption rights to the EC2 service for attaching and mounting the EBS root volume.

Key Concept

Cross-account KMS Customer Managed Key sharing with service-linked roles for encrypted AMI deployments.
Estimated Time:2m 30s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic