Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A financial company is building a regulatory compliance portal in a production account (Account ID 999988887777999988887777). The portal needs to securely ingest audit reports generated by a third-party audit firm's application. The third-party application runs on-premises and must authenticate via an external SAML 2.0 identity provider (IdP). The portal must store these files in an Amazon S3 bucket encrypted using AWS KMS. The audit firm's application will upload the files directly to the S3 bucket using temporary security credentials. Which set of configurations should the solutions architect recommend to meet these requirements?

  1. A
    Create a SAML identity provider in IAM within the production account. Create an IAM role with a trust policy that allows the `sts:AssumeRole` action for the SAML provider principal. Attach an IAM policy to the role that grants `s3:PutObject` on the S3 bucket, and `kms:GenerateDataKey` and `kms:Decrypt` on a Customer Managed Key (CMK). Configure the CMK's key policy to permit the IAM role to use the key.
  2. B
    Create a SAML identity provider in IAM within the production account. Create an IAM role with a trust policy that allows the `sts:AssumeRoleWithSAML` action for the SAML provider principal. Attach an IAM policy to the role that grants `s3:PutObject` on the S3 bucket. Configure the S3 bucket to use the default AWS managed key (`aws/s3`) and modify its key policy to allow the IAM role to perform `kms:GenerateDataKey` and `kms:Decrypt`.
  3. Create a SAML identity provider in IAM within the production account. Create an IAM role with a trust policy that allows the `sts:AssumeRoleWithSAML` action for the SAML provider principal. Attach an IAM policy to the role that grants `s3:PutObject` on the S3 bucket, and `kms:GenerateDataKey` and `kms:Decrypt` on a Customer Managed Key (CMK). Configure the CMK's key policy to permit the IAM role to use the key.Answer
  4. D
    Create a SAML identity provider in IAM within the production account. Create an IAM role with a trust policy that allows the `sts:AssumeRoleWithSAML` action. Attach a Service Control Policy (SCP) to the production account's Organizational Unit (OU) that grants `s3:PutObject` and `kms:GenerateDataKey` permissions to the SAML provider principal, eliminating the need to attach an IAM permission policy to the IAM role.

Answer

Create a SAML identity provider in IAM within the production account. Create an IAM role with a trust policy that allows the `sts:AssumeRoleWithSAML` action for the SAML provider principal. Attach an IAM policy to the role that grants `s3:PutObject` on the S3 bucket, and `kms:GenerateDataKey` and `kms:Decrypt` on a Customer Managed Key (CMK). Configure the CMK's key policy to permit the IAM role to use the key.
The correct solution involves creating a SAML identity provider in IAM and an IAM role with a trust policy that allows the `sts:AssumeRoleWithSAML` action. Furthermore, a Customer Managed Key (CMK) must be used since its key policy can be modified to grant the assumed role permissions to generate data keys and decrypt. Finally, the IAM role must have an attached permission policy that allows S3 uploads and KMS cryptographic actions.

Step-by-Step Solution

1
Establish trust for the third-party application using SAML federation.
A SAML identity provider is configured in IAM, and an IAM role is created with a trust policy allowing `sts:AssumeRoleWithSAML`.
SAML federation requires the specific `sts:AssumeRoleWithSAML` API action to exchange SAML assertions for temporary AWS security credentials.
2
Configure server-side encryption using a Customer Managed Key (CMK).
A CMK is created, and the KMS key policy is updated to allow the IAM role to perform `kms:GenerateDataKey` and `kms:Decrypt`.
AWS managed keys (like `aws/s3`) cannot be used for cross-account or external service delegation because their key policies cannot be modified.
3
Assign standard permission policies to the IAM role.
An IAM policy is attached to the role granting `s3:PutObject` on the S3 bucket.
SCPs only restrict permissions and do not grant them; therefore, an IAM policy attached to the role is required to authorize the upload.

Key Concept

Configuring identity federation and customer-managed KMS key policies for secure data ingestion.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic