Examkin

Question

Difficulty: MediumEnhancing Data Protection and Compliance

An enterprise operates a multi-account structure in AWS Organizations. An existing application in several member accounts stores sensitive compliance reports in Amazon S3 buckets. Currently, these S3 buckets are encrypted at rest using the AWS-managed KMS key (aws/s3). To meet new regulatory compliance requirements, a centralized auditing application running under an IAM role in a separate Security account must perform periodic read-only audits of these S3 buckets.

Which strategy should a solutions architect implement to enhance data protection and allow the auditing application to access the encrypted data?

  1. Replace the S3 bucket default encryption with Customer Managed Keys (CMKs) created in each member account. Configure the key policies of these CMKs to grant the security auditing IAM role permission to perform decrypt operations.Answer
  2. B
    Keep the S3 bucket default encryption set to the AWS-managed KMS key. Update the S3 bucket policy in each member account to grant decrypt permissions on the key and read permissions on the objects to the security auditing IAM role.
  3. C
    Retain the AWS-managed KMS key for S3 bucket encryption. Attach a Service Control Policy (SCP) at the Organizational Unit level that grants the security auditing IAM role decryption permissions to the AWS-managed KMS key in each member account.
  4. D
    Continue using the AWS-managed KMS key for default encryption. In the Security account, update the IAM policy of the auditing role to allow decryption operations targeting the AWS-managed KMS keys in the member accounts.

Answer

Replace the S3 bucket default encryption with Customer Managed Keys (CMKs) in each member account, and update their key policies to grant the security auditing IAM role decrypt permissions.
The correct strategy is to use Customer Managed Keys (CMKs) in each member account and configure their key policies to grant decrypt permissions to the auditing IAM role. AWS-managed keys (such as aws/s3) do not support key policy modifications and cannot be shared across different accounts, meaning that any solution relying on the default aws/s3 key will fail. By using CMKs, the key owners in the member accounts can delegate KMS decrypt capabilities to the external IAM role in the Security account, which when paired with a matching IAM policy on the auditing role, enables secure cross-account access.

Step-by-Step Solution

1
Identify the key management constraints of AWS-managed KMS keys.
AWS-managed keys (like aws/s3) cannot be shared across accounts because their key policies cannot be modified.
This establishes that the default aws/s3 key cannot support cross-account access for the Security auditing role.
2
Create Customer Managed Keys (CMKs) in each member account.
CMKs are provisioned in the member accounts to replace the default encryption.
CMKs allow administrators to customize key policies to grant cross-account permissions.
3
Modify CMK key policies and auditing role IAM policies.
The CMK key policy allows kms:Decrypt to the Security auditing role ARN, and the auditing role's IAM policy allows kms:Decrypt on the CMK ARNs.
Cross-account KMS access requires explicit permission in both the key policy (trust provider) and the IAM policy (trust consumer).

Key Concept

Cross-account AWS KMS access controls and key type limitations
Rate this question

Topics

Enhancing Data Protection and Compliance