Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

An enterprise manages its multi-account AWS environment using AWS Organizations. The central DevOps team uses AWS CloudFormation StackSets to deploy and update application infrastructure, including security groups and Amazon S3 buckets, across multiple member accounts. The deployment artifacts are stored in a central S3 bucket and encrypted using a Customer Managed Key (CMK) in the central DevOps account.

Recently, several stack updates failed because local administrators in the member accounts had manually modified security group rules and S3 bucket policies, causing configuration drift. Additionally, the member accounts are unable to access the deployment artifacts due to KMS decryption failures.

Which two actions should the Solutions Architect take to automate drift remediation and resolve the cross-account decryption failures? (Select two.)

  1. Update the key policy of the Customer Managed Key in the central DevOps account to grant decrypt permissions (kms:Decrypt) to the IAM execution roles in the member accounts, and ensure these roles also have local IAM policies allowing the KMS decrypt action.Answer
  2. Deploy AWS Config rules across the member accounts to monitor security groups and S3 bucket configurations, and configure AWS Systems Manager Automation as a remediation action to automatically restore drifted resources to their compliant configurations.Answer
  3. C
    Enable the AWS-managed KMS key (aws/s3) in the central DevOps account to encrypt the artifacts, and modify its key policy to delegate cross-account decrypt permissions to the IAM execution roles in the member accounts.
  4. D
    Enable automatic drift remediation directly within the AWS CloudFormation StackSet configuration parameters to automatically detect configuration changes and perform a stack update to overwrite manual modifications in target accounts.
  5. E
    Attach a Service Control Policy (SCP) to the member account Organizational Units (OUs) that grants the kms:Decrypt permission for the central DevOps account's KMS key, eliminating the need for local IAM policy configurations in the member accounts.

Answer

Update the Customer Managed Key policy in the central DevOps account to grant decrypt permissions to the member accounts' IAM roles and configure matching local IAM policies, and deploy AWS Config rules with AWS Systems Manager Automation to automatically remediate resource configuration drift.
For cross-account KMS decryption, the Customer Managed Key policy in the owning account must delegate permissions to the external accounts, and the IAM policies in those external accounts must grant the roles permission to call the KMS decrypt action. For drift remediation, deploying AWS Config rules combined with AWS Systems Manager Automation allows the environment to continuously detect unauthorized configuration changes and automatically execute a remediation runbook to restore resources to their defined configurations, ensuring smooth deployment pipeline operations.

Step-by-Step Solution

1
Configure cross-account KMS access.
The key policy of the Customer Managed Key (CMK) in the central DevOps account is updated to include the member accounts' IAM execution roles as authorized principals for the kms:Decrypt action, and local IAM policies in the member accounts are configured to allow those roles to perform the decrypt operation.
This establishes the necessary trust relationship and permissions for cross-account resource access, which is required because AWS-managed keys cannot be shared cross-account.
2
Implement automated drift detection and remediation.
AWS Config rules are deployed to monitor resource configurations (security groups and S3 buckets). When drift is detected, AWS Config automatically triggers an AWS Systems Manager Automation runbook that applies the compliant configuration.
This automates the remediation of unauthorized configuration changes, preventing future stack update failures due to configuration drift.

Key Concept

Cross-account KMS key sharing requires both key policy delegation and local IAM permissions, while configuration drift is best managed using AWS Config combined with AWS Systems Manager Automation for remediation.
Estimated Time:3m 0s
Rate this question

Topics

Automating Deployment and Configuration Management