Examkin

Question

Difficulty: Very hardEnhancing Data Protection and Compliance

A financial services company is centralizing audit transaction logs from multiple member accounts within an AWS Organization into a single Amazon S3 bucket in a dedicated Compliance account. The existing logs in the member accounts are currently encrypted using Customer Managed Keys (CMKs) in AWS Key Management Service (AWS KMS). The company requires that all replicated logs in the Compliance account be encrypted with a key owned by the Compliance account, and that member accounts must be blocked from decrypting any logs once they are successfully copied. Additionally, all existing logs must be backfilled to the centralized bucket. A Solutions Architect configures S3 Cross-Region Replication (CRR) on the source buckets in the member accounts. However, the replication jobs fail to copy any existing logs, and new logs replicated to the Compliance account remain encrypted with the member accounts' KMS keys. Which combination of actions will successfully resolve these issues and meet the security requirements?

  1. A
    Configure default encryption on the destination S3 bucket in the Compliance account using the default AWS managed KMS key (aws/s3). Update the IAM replication roles in the member accounts to grant cross-account permissions for the aws/s3 key, then execute an S3 Batch Operations job to copy the existing logs.
  2. B
    Create a Customer Managed Key (CMK) in the Compliance account. Attach a Service Control Policy (SCP) to the organization's root that explicitly permits the member accounts' replication roles to perform kms:GenerateDataKey, kms:Encrypt, and kms:Decrypt actions on the Compliance account's CMK. Run an S3 Batch Replication job in each member account.
  3. Create a Customer Managed Key (CMK) in the Compliance account and modify its key policy to grant the source replication IAM roles kms:GenerateDataKey and kms:Encrypt permissions. Configure replication rules in the member accounts to use the Compliance account's CMK for encrypting replicas, and execute S3 Batch Replication jobs in each member account to backfill the existing logs.Answer
  4. D
    Create a Customer Managed Key (CMK) in the Compliance account. Update the destination S3 bucket policy in the Compliance account to grant kms:GenerateDataKey and kms:Encrypt permissions on the CMK to the replication IAM roles of the member accounts. Configure the member accounts' replication rules to point to the destination bucket's key, and run S3 Batch Replication jobs.

Answer

Create a Customer Managed Key (CMK) in the Compliance account and modify its key policy to grant the source replication IAM roles kms:GenerateDataKey and kms:Encrypt permissions. Configure replication rules in the member accounts to use the Compliance account's CMK for encrypting replicas, and execute S3 Batch Replication jobs in each member account to backfill the existing logs.
The correct answer provides a valid path for cross-account S3 replication of KMS-encrypted objects. It addresses the limitation of AWS-managed keys by using a Customer Managed Key (CMK) in the Compliance account and updating its key policy to allow the member accounts' replication roles to perform encryption operations (kms:GenerateDataKey and kms:Encrypt). By not granting kms:Decrypt, it guarantees that member accounts cannot read the replicated archives. Finally, it uses S3 Batch Replication to resolve the failure to replicate existing logs, which are otherwise ignored by live S3 replication rules.

Step-by-Step Solution

1
Analyze cross-account key sharing capability
Determine that default AWS managed keys (aws/s3) cannot be shared across accounts due to non-modifiable key policies, necessitating a Customer Managed Key (CMK) in the destination Compliance account.
AWS-managed keys do not permit external principles in their policies.
2
Configure destination key policy for write-only permission
Add kms:GenerateDataKey and kms:Encrypt permissions for the replication roles, while omitting kms:Decrypt.
This enables source replication roles to encrypt objects using the destination key without granting them read access to the replicated data.
3
Configure the S3 replication rule parameters
Enable replication of KMS-encrypted objects and specify the Compliance account CMK ARN as the destination encryption key.
Forces the replication process to re-encrypt the replicated objects with the destination key instead of preserving the source key.
4
Address the replication of existing logs
Create and execute S3 Batch Replication jobs in each member account.
Standard S3 replication only triggers on new PUT operations. S3 Batch Replication is required to backfill existing historical data.

Key Concept

Cross-account S3 replication with KMS encryption requires a destination Customer Managed Key (CMK) with a key policy permitting external replication roles to encrypt, and S3 Batch Replication to copy pre-existing objects.
Estimated Time:3m 0s
Rate this question

Topics

Enhancing Data Protection and Compliance