An energy transmission operator uses AWS Organizations to manage its multi-account environ… — AWS Certified Solutions Architect - Professional

An energy transmission operator uses AWS Organizations to manage its multi-account environment. To comply with national security regulations, all grid control plane access logs from the Grid Operations account (Account ID: $444455556666$ ) must be archived to a centralized compliance S3 bucket in the Security Auditing account (Account ID: $111122223333$ ).

The security engineering team has established the following requirements:
1. All logs must be encrypted at rest using a Customer Managed Key (CMK) created and managed in the Security Auditing account.
2. The Grid Operations account must have permissions to upload log files to the compliance S3 bucket but must be strictly prevented from decrypting or reading any logs once they are archived.
3. The objects uploaded to the compliance S3 bucket must be owned by the Security Auditing account to ensure compliance audits can access them.

Which combination of configurations will securely meet these requirements?

A
In the Security Auditing account ( $111122223333$ ), enable default encryption on the compliance S3 bucket using the AWS-managed key for Amazon S3 (aws/s3). Configure the bucket policy to grant the Grid Operations account's IAM role (GridLoggerRole) permissions to perform s3:PutObject. In the Grid Operations account ( $444455556666$ ), attach an IAM policy to GridLoggerRole allowing s3:PutObject on the compliance S3 bucket and kms:GenerateDataKey on the aws/s3 key.
B
In the Security Auditing account ( $111122223333$ ), configure the compliance S3 bucket with S3 Object Ownership set to Object Writer. Modify the bucket policy to allow the Grid Operations account's IAM role (GridLoggerRole) to perform s3:PutObject with a condition requiring the bucket-owner-full-control canned ACL. In the KMS key policy, grant GridLoggerRole permission to perform kms:GenerateDataKey, kms:DescribeKey, and kms:Decrypt. In the Grid Operations account ( $444455556666$ ), attach an IAM policy to GridLoggerRole allowing s3:PutObject and the required ACL.
In the Security Auditing account ( $111122223333$ ), configure the compliance S3 bucket with S3 Object Ownership set to Bucket Owner Enforced. Apply a bucket policy that allows the Grid Operations account's IAM role (GridLoggerRole) to perform s3:PutObject. Create a KMS Customer Managed Key (CMK) and modify its key policy to allow GridLoggerRole to perform kms:GenerateDataKey and kms:DescribeKey, while omitting kms:Decrypt. In the Grid Operations account ( $444455556666$ ), attach an IAM policy to GridLoggerRole that allows s3:PutObject on the compliance S3 bucket and kms:GenerateDataKey and kms:DescribeKey on the KMS CMK.Answer
D
In the Security Auditing account ( $111122223333$ ), configure the compliance S3 bucket with S3 Object Ownership set to Bucket Owner Enforced. Apply a bucket policy that allows the Grid Operations account's IAM role (GridLoggerRole) to perform s3:PutObject. Create a KMS Customer Managed Key (CMK) and modify its key policy to allow the Grid Operations account root principal to perform all KMS actions, including kms:Decrypt. In the AWS Organizations management account, attach a Service Control Policy (SCP) to the Grid Operations OU that explicitly denies kms:Decrypt and s3:GetObject to GridLoggerRole.

Answer

The correct option is the configuration that sets S3 Object Ownership to Bucket Owner Enforced in the Security Auditing account, creates a Customer Managed Key (CMK) that grants kms:GenerateDataKey and kms:DescribeKey to the logging role while omitting kms:Decrypt, and configures the corresponding S3 bucket policy and IAM policy in the Grid Operations account.

The correct solution uses S3 Object Ownership set to Bucket Owner Enforced, which disables Access Control Lists (ACLs) and automatically transfers ownership of all uploaded objects to the bucket owner. To meet the security constraint of preventing the logging role from decrypting written logs, the Customer Managed Key (CMK) policy in the Auditing account must explicitly grant kms:GenerateDataKey and kms:DescribeKey to the logging role while omitting kms:Decrypt. The IAM policy in the logging account and the S3 bucket policy in the auditing account must also align with these restricted permissions.

Step-by-Step Solution

Ensure that the Security Auditing account automatically owns all uploaded log files.

Configure S3 Object Ownership on the compliance S3 bucket to Bucket Owner Enforced, which disables ACLs and automatically transfers ownership of all uploaded objects to the bucket owner.

This guarantees that the Security Auditing account can manage and audit the uploaded logs, satisfying the ownership requirement.

Enable cross-account S3 write permissions.

Apply a bucket policy on the compliance S3 bucket in the Security Auditing account that grants the Grid Operations role (GridLoggerRole) permission to perform s3:PutObject.

Allows the logging service in the remote account to write files to the centralized bucket.

Configure the encryption keys to enforce write-only compliance.

Create a Customer Managed Key (CMK) in the Security Auditing account and configure its key policy to allow the GridLoggerRole to perform kms:GenerateDataKey and kms:DescribeKey, while omitting the kms:Decrypt permission.

Allows the logging role to generate the data keys needed to encrypt and upload objects, but prevents it from decrypting or reading the uploaded logs.

Configure the local permissions in the source account.

Attach an IAM policy to GridLoggerRole in the Grid Operations account allowing s3:PutObject on the compliance S3 bucket and kms:GenerateDataKey/kms:DescribeKey on the Security Auditing KMS CMK.

Permits the logging role to invoke the necessary S3 and KMS actions from the source account.

Key Concept

Cross-account S3 bucket log delivery using S3 Bucket Owner Enforced ownership and KMS Customer Managed Keys with write-only policy constraints.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic