Examkin

Question

Difficulty: MediumSecurity and Compliance Control Design

A healthcare organization is designing a telemetry processing system. An ingestion application running on Amazon EC2 instances in an Ingestion account (Account ID 222233334444222233334444) must write sensitive telemetry data to an Amazon S3 bucket located in a dedicated Audit account (Account ID 555566667777555566667777). The organization's compliance policy requires all data to be encrypted at rest using a key managed by the security team. The solutions architect must configure the cross-account permissions and encryption controls to allow this transmission. Which two actions must the solutions architect take to meet these requirements? (Select TWO.)

  1. Create a Customer Managed Key (CMK) in AWS KMS within the Audit account. Configure the KMS key policy in the Audit account to allow the Ingestion account's IAM role to perform kms:GenerateDataKey and kms:Decrypt operations.Answer
  2. Configure the S3 bucket policy in the Audit account to grant s3:PutObject permissions to the specific IAM role ARN from the Ingestion account.Answer
  3. C
    Configure the S3 bucket in the Audit account to use the AWS-managed KMS key for Amazon S3 (aws/s3), and modify its key policy to grant the Ingestion account's IAM role kms:GenerateDataKey permissions.
  4. D
    Attach a Service Control Policy (SCP) at the Organization Unit (OU) level containing both accounts that grants s3:PutObject permissions to the Ingestion account's IAM role for the destination S3 bucket.
  5. E
    Configure the S3 bucket policy in the Audit account to grant s3:PutObject permissions using a wildcard principal (Principal: "*") without specifying any organizational conditions or principal AWS account IDs.

Answer

Create a Customer Managed Key (CMK) in AWS KMS within the Audit account, configure its policy to allow the Ingestion account's IAM role to perform kms:GenerateDataKey and kms:Decrypt operations, and configure the S3 bucket policy in the Audit account to grant s3:PutObject permissions to the specific IAM role ARN from the Ingestion account.
The correct options are configuring a Customer Managed Key (CMK) in the Audit account with a policy allowing the Ingestion account's IAM role to perform kms:GenerateDataKey and kms:Decrypt, and configuring the S3 bucket policy in the Audit account to grant s3:PutObject permissions to the Ingestion account's IAM role. This combination ensures that the ingestion application has both S3 write permissions and KMS key permissions to encrypt and upload objects securely across accounts using a Customer Managed Key, which is required since AWS-managed KMS keys do not support policy modification.

Step-by-Step Solution

1
Determine key management strategy for cross-account S3 uploads.
AWS-managed KMS keys cannot be used because they do not support cross-account access. A Customer Managed Key (CMK) is created in the Audit account.
Only Customer Managed Keys support policy edits required to allow cross-account access.
2
Configure the KMS key policy in the Audit account.
Update the key policy to grant the Ingestion account's IAM role permissions for kms:GenerateDataKey and kms:Decrypt.
The ingestion application needs kms:GenerateDataKey to encrypt the object during upload, and kms:Decrypt is required for multipart uploads and validation.
3
Configure the destination S3 bucket policy.
Apply a bucket policy in the Audit account granting s3:PutObject to the Ingestion account's IAM role.
S3 cross-account access requires explicit permission in the resource-based policy of the receiving account.

Key Concept

Cross-account KMS key and S3 bucket policy configuration
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic