Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

An energy trading enterprise runs its core transaction processing platform on Amazon ECS tasks within a Production account (Account 111111111111). The enterprise is designing a compliance archiving architecture where transaction logs must be written directly from the ECS tasks to an Amazon S3 bucket located in a dedicated Audit account (Account 222222222222).

The security requirements are as follows:
- Cryptographic control over the logs must remain within the Production account.
- The logs must be encrypted at rest when stored in the S3 bucket.
- The Audit account users must have the ability to read and decrypt these logs.
- The S3 Object Ownership must be configured so that the Audit account automatically owns all uploaded logs, and access control lists (ACLs) are disabled.
- The ECS task roles must be granted only the minimum required permissions.

Which configuration strategy meets these requirements while adhering to the principle of least privilege?

  1. In Account 111111111111, create a KMS customer managed key (CMK). Configure the CMK key policy to allow the Production ECS task role to perform kms:GenerateDataKey and kms:Decrypt, and allow Account 222222222222 to perform kms:Decrypt. In Account 222222222222, set S3 Object Ownership to Bucket Owner Enforced on the S3 bucket. Configure the S3 bucket policy to allow s3:PutObject permissions only to the Production ECS task role principal. Attach an IAM policy to the Production ECS task role that grants s3:PutObject on the Audit S3 bucket and kms:GenerateDataKey and kms:Decrypt on the Production CMK.Answer
  2. B
    In Account 111111111111, configure the ECS tasks to encrypt S3 uploads using the AWS-managed KMS key aws/s3. In Account 222222222222, set S3 Object Ownership to Bucket Owner Enforced on the S3 bucket. Configure the S3 bucket policy to allow s3:PutObject permissions to the Production ECS task role principal. Attach an IAM policy to the Production ECS task role that grants s3:PutObject on the Audit S3 bucket and kms:GenerateDataKey on the aws/s3 key.
  3. C
    In Account 111111111111, create a KMS customer managed key (CMK). Configure the CMK key policy to allow the Production ECS task role to perform kms:GenerateDataKey and kms:Decrypt, and allow Account 222222222222 to perform kms:Decrypt. Attach a Service Control Policy (SCP) to the Production Organizational Unit (OU) that allows s3:PutObject on the Audit S3 bucket, and rely on this SCP to grant the ECS task role write permissions without a local IAM policy. In Account 222222222222, set S3 Object Ownership to Bucket Owner Enforced and configure the S3 bucket policy to allow s3:PutObject permissions to the Production ECS task role principal.
  4. D
    In Account 111111111111, create a KMS customer managed key (CMK). Configure the CMK key policy to allow the Production ECS task role to perform kms:GenerateDataKey and kms:Decrypt, and allow Account 222222222222 to perform kms:Decrypt. In Account 222222222222, set S3 Object Ownership to Bucket Owner Enforced. Configure the S3 bucket policy to allow s3:PutObject with a Principal of * and use the aws:PrincipalOrgID condition key to restrict access to the organization, omitting specific ECS task role principal declarations. Attach an IAM policy to the Production ECS task role that grants s3:PutObject on the Audit S3 bucket and kms:GenerateDataKey and kms:Decrypt on the Production CMK.

Answer

The correct strategy is to create a customer managed key in the Production Account, configure its key policy to allow the Production ECS task role to use it and the Audit Account to decrypt with it. On the Audit S3 bucket, configure S3 Object Ownership to Bucket Owner Enforced, and set the S3 bucket policy to allow only the Production ECS task role to write objects. Finally, attach an IAM policy to the Production ECS task role that grants S3 write permissions and KMS access.
The correct strategy uses a Customer Managed Key (CMK) in the Production Account to keep cryptographic control there, while updating its key policy to delegate decrypt permissions to the Audit Account. By setting the S3 Object Ownership to Bucket Owner Enforced in the Audit Account, S3 automatically transfers ownership of the uploaded objects to the Audit Account and disables ACLs. The S3 bucket policy specifies the exact ECS task role principal, and a local IAM policy explicitly grants the ECS task role the required write and encryption permissions. This setup meets all compliance, ownership, and least privilege requirements.

Step-by-Step Solution

1
Select a key type and location that allows cross-account policy modification to meet the encryption and compliance requirements.
Create a Customer Managed Key (CMK) in the Production Account (111111111111). AWS-managed keys (e.g., aws/s3) cannot be shared across accounts as their key policies are immutable.
Cryptographic control must remain with the Production Account, and the key policy must be modified to delegate decrypt permissions to the Audit Account.
2
Establish cross-account encryption and decryption rights in the KMS key policy.
The key policy in Account 111111111111 is configured to allow the Production ECS task role to use the key for encryption (GenerateDataKey, Decrypt) and allows Account 222222222222 to use the key for decryption (Decrypt).
This allows the Production ECS tasks to encrypt the transaction logs during upload, and allows the Audit Account to decrypt them when reading.
3
Ensure the Audit Account owns all uploaded files and disable Access Control Lists (ACLs) to simplify compliance management.
Set S3 Object Ownership to Bucket Owner Enforced on the Audit S3 bucket in Account 222222222222.
This automatically transfers ownership of all uploaded objects to the Audit Account and disables ACLs, ensuring the Audit Account can manage and read the logs.
4
Apply explicit write permissions on both the source IAM identity and the destination S3 bucket resource policy using the principle of least privilege.
The S3 bucket policy in Account 222222222222 is configured to permit the specific ECS task role ARN from Account 111111111111 to perform s3:PutObject. A local IAM policy is attached to the ECS task role in Account 111111111111 granting s3:PutObject on the Audit S3 bucket and kms:GenerateDataKey and kms:Decrypt on the Production CMK.
Cross-account access requires explicit permission in both the IAM policy of the caller and the resource-based policy of the target bucket. Restricting the bucket policy to the specific ECS task role (rather than using wildcard principals with organizational conditions) enforces least privilege.

Key Concept

Cross-Account S3 Access with KMS CMK Encryption and S3 Object Ownership
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic