Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

An enterprise is designing a centralized auditing solution where a data ingestion application running under an IAM role in a Production account (111122223333) must write audit logs to an Amazon S3 bucket located in a Security account (444455556666). The compliance requirements state that all logs must be encrypted at rest, and a compliance auditor using a role in the Audit account (777788889999) must be able to read and decrypt the logs. Additionally, to maintain chain of custody, administrators in the Production account must not have the ability to decrypt the logs once they are uploaded. Which configuration meets these requirements?

  1. Create both the S3 bucket and a customer managed key (CMK) in the Security account. Configure S3 default encryption on the bucket using this CMK. Update the KMS key policy to grant kms:GenerateDataKey to the Production application role, and kms:Decrypt to the Audit compliance role. Configure the S3 bucket policy to allow s3:PutObject from the Production application role and s3:GetObject from the Audit compliance role.Answer
  2. B
    Configure the S3 bucket in the Security account to use default S3 encryption with the AWS managed key (aws/s3). Create a bucket policy that grants s3:PutObject to the Production application role and s3:GetObject to the Audit compliance role. Grant the Audit compliance role decryption permissions using local IAM policies in the Production account.
  3. C
    Create both the S3 bucket and a customer managed key (CMK) in the Security account. Create a Service Control Policy (SCP) at the AWS Organizations root level that allows the Audit compliance role to perform kms:Decrypt and s3:GetObject on the Security account resources. Attach this SCP to the OUs containing the Production and Audit accounts.
  4. D
    Create the S3 bucket and a customer managed key (CMK) in the Security account. Configure the KMS key policy to trust the Audit account for kms:Decrypt operations. Authorize the Audit compliance role to read S3 objects by configuring local IAM policies in the Audit account, without adding the Audit role to the S3 bucket policy in the Security account.

Answer

Create both the S3 bucket and a customer managed key (CMK) in the Security account, configure S3 default encryption using this CMK, grant key permissions to the respective roles, and configure the S3 bucket policy to explicitly allow cross-account access.
The correct option correctly positions the customer managed KMS key (CMK) and the S3 bucket within the Security account. This architecture prevents Production account administrators from overriding policies or obtaining decryption permissions. The KMS key policy explicitly permits the Production application to generate data keys for encryption, while permitting the Audit compliance role to decrypt the data. The S3 bucket policy permits the necessary cross-account read and write operations, satisfying all compliance and access requirements.

Step-by-Step Solution

1
Select the correct KMS key type for cross-account sharing.
Determine that a Customer Managed Key (CMK) is required because AWS managed keys (such as aws/s3) cannot be shared across accounts due to immutable key policies.
AWS managed keys restrict access to the local account, so cross-account decryption requires a customer managed key.
2
Determine the resource hosting account for compliance separation.
Create the KMS CMK and S3 bucket in the Security account.
By hosting the KMS key in the Security account, Production account administrators cannot access or modify the key policy, preserving the chain of custody.
3
Configure the resource-based access policies in the Security account.
Grant write access (s3:PutObject and kms:GenerateDataKey) to the Production application role, and read access (s3:GetObject and kms:Decrypt) to the Audit compliance role.
Resource-based policies (bucket policy and KMS key policy) must explicitly authorize cross-account actions for the external accounts to access resources.

Key Concept

Cross-account S3 and KMS key policy delegation for regulatory data segregation.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic