Examkin

Question

Difficulty: Very hardSecurity and Compliance Control Design

A retail company is designing a new compliance-regulated transaction ingestion pipeline. The architecture utilizes two AWS accounts within the same AWS Organization: an Ingestion Account (account ID 111122223333) and an Analytics Account (account ID 444455556666). An application running on Amazon ECS tasks in the Ingestion Account must write transactional data directly to an Amazon S3 bucket in the Analytics Account. The security architecture mandates that all uploaded data must be encrypted at rest, and the Analytics Account must retain absolute ownership of all objects uploaded by the external Ingestion Account without requiring the use of S3 Access Control Lists (ACLs). Which TWO configurations must be implemented to establish this secure cross-account ingestion pipeline? (Select TWO.)

  1. In the Analytics Account, configure the S3 Object Ownership setting on the S3 bucket to Bucket owner enforced to disable ACLs and automatically transfer ownership of all uploaded objects.Answer
  2. In the Analytics Account, configure the S3 bucket default encryption to use a Customer Managed Key (CMK), and update its key policy to grant the ECS task role in the Ingestion Account permissions for kms:GenerateDataKey and kms:Decrypt.Answer
  3. C
    In the Analytics Account, configure the S3 bucket default encryption to use the AWS-managed KMS key for S3 (aws/s3), and configure the key policy to delegate cross-account access to the ECS task role in the Ingestion Account.
  4. D
    In the Ingestion Account, configure an IAM policy attached to the ECS task role to grant write access to the S3 bucket in the Analytics Account, and omit the S3 bucket policy in the Analytics Account as IAM permissions are transitive across accounts within the same Organization.
  5. E
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the Ingestion Account that explicitly grants the ECS task role access to write to the S3 bucket in the Analytics Account, eliminating the need to configure a local IAM policy in the Ingestion Account.

Answer

In the Analytics Account, configure the S3 Object Ownership setting on the S3 bucket to Bucket owner enforced, and configure the S3 bucket default encryption to use a Customer Managed Key (CMK), updating its key policy to grant the ECS task role in the Ingestion Account permissions for kms:GenerateDataKey and kms:Decrypt.
The correct architecture requires configuring the destination S3 bucket's Object Ownership setting to Bucket owner enforced to eliminate the dependency on ACLs and automatically transfer ownership of files uploaded from the Ingestion Account. Additionally, the bucket must be configured with a Customer Managed KMS Key (CMK) whose key policy explicitly grants the ECS task role in the Ingestion Account permission to execute kms:GenerateDataKey and kms:Decrypt, which are required for cross-account S3 KMS uploads.

Step-by-Step Solution

1
Address the object ownership requirement by disabling ACLs.
Configure S3 Object Ownership to 'Bucket owner enforced' on the target bucket in the Analytics Account.
This configuration disables all ACLs on the bucket and ensures that any object uploaded by a cross-account identity is automatically owned by the bucket owner (Analytics Account) without needing explicit ACL permissions.
2
Evaluate KMS key type selection for cross-account S3 encryption.
Identify that a Customer Managed Key (CMK) must be used instead of an AWS-managed key.
AWS-managed KMS keys (like aws/s3) have fixed policies that cannot be modified to authorize cross-account access, whereas CMK policies can be explicitly customized.
3
Configure permissions on the selected Customer Managed Key.
Modify the CMK's key policy in the Analytics Account to grant the Ingestion Account's ECS task role permissions for kms:GenerateDataKey and kms:Decrypt.
When S3 encrypts objects using KMS keys during a cross-account PutObject, the uploading principal must be authorized by the KMS key policy to perform these actions.

Key Concept

Cross-account resource access control design using S3 Bucket Policies, Object Ownership, and Customer Managed KMS Keys.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic