Examkin

Question

Difficulty: Very hardSecurity and Compliance Control Design

A digital broadcasting company is launching a global video-on-demand platform. Transcoding engines running on Amazon ECS on AWS Fargate in the Media Processing Account (222244446666)needtowriteprocessedvideosegmentsdirectlytoanAmazonS3bucketlocatedintheContentDistributionAccount(222244446666) need to write processed video segments directly to an Amazon S3 bucket located in the Content Distribution Account ( 888800002222). To comply with digital rights management (DRM) policies, all video files must be encrypted at rest with AWS Key Management Service (AWS KMS), and the transcoding engines must only be allowed to encrypt the assets without having permission to decrypt them after writing. Which combination of configurations will successfully allow the ECS tasks in the Media Processing Account to write these encrypted video segments to the S3 bucket in the Content Distribution Account while adhering to the principle of least privilege?

  1. Create a Customer Managed Key (CMK) in the Content Distribution Account. Configure the key policy of the CMK to grant the Media Processing Account's ECS task role permissions to perform `kms:GenerateDataKey`. In the Content Distribution Account, configure the S3 bucket policy to allow the ECS task role `s3:PutObject` permissions. In the Media Processing Account, configure the ECS task IAM role with permissions to perform `s3:PutObject` on the target S3 bucket and `kms:GenerateDataKey` on the CMK in the Content Distribution Account.Answer
  2. B
    Use the default AWS-managed KMS key for Amazon S3 (`aws/s3`) in the Content Distribution Account. Configure the S3 bucket policy in the Content Distribution Account to allow `s3:PutObject` from the Media Processing Account's ECS task role. In the Media Processing Account, attach an IAM policy to the ECS task role that allows `s3:PutObject` on the target bucket and `kms:GenerateDataKey` on the `aws/s3` key.
  3. C
    Create a Customer Managed Key (CMK) in the Content Distribution Account. Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing both accounts that explicitly allows `s3:PutObject` and `kms:GenerateDataKey` across all resources. Rely on this SCP to grant the necessary cross-account write permissions to the ECS tasks without configuring individual IAM policies or the S3 bucket policy.
  4. D
    Create a Customer Managed Key (CMK) in the Content Distribution Account. Configure the S3 bucket policy in the Content Distribution Account to allow the Media Processing Account's root principal to perform `s3:PutObject` and `kms:GenerateDataKey` operations. In the Media Processing Account, configure the ECS task IAM role with `s3:PutObject` and `kms:GenerateDataKey` permissions, relying on the bucket policy to delegate the KMS authorization.

Answer

Create a Customer Managed Key (CMK) in the Content Distribution Account, configure the key policy to grant the ECS task role permissions to perform `kms:GenerateDataKey`, configure the S3 bucket policy to allow the ECS task role `s3:PutObject`, and configure the ECS task IAM role in the Media Processing Account with permissions for both `s3:PutObject` and `kms:GenerateDataKey`.
The correct configuration uses a Customer Managed Key (CMK) in the destination account because AWS-managed keys cannot be shared cross-account. Since the task only needs to write (encrypt) data, granting only the `kms:GenerateDataKey` permission aligns with the least privilege principle and prevents it from decrypting the files later. The bucket policy explicitly allows the Fargate task role to perform `s3:PutObject`, and the task role's IAM policy in the processing account allows both the S3 write action and the KMS data key generation action.

Step-by-Step Solution

1
Determine the type of KMS key needed for cross-account S3 encryption.
Identify that a Customer Managed Key (CMK) must be used, as the default AWS-managed KMS key (`aws/s3`) cannot be configured with cross-account permissions.
AWS-managed keys do not allow modifications to their key policies, making them unusable for cross-account access.
2
Configure permissions in the destination Content Distribution Account.
Add an S3 bucket policy allowing `s3:PutObject` for the ECS task role in the Media Processing Account, and add a KMS key policy allowing `kms:GenerateDataKey` for the same role.
Resource policies in the owning account must explicitly trust the external account's role to access the S3 bucket and the encryption key.
3
Configure permissions in the source Media Processing Account.
Attach an IAM policy to the ECS task role allowing `s3:PutObject` on the target bucket and `kms:GenerateDataKey` on the CMK.
The caller's IAM role must have explicit permission to access target resources in another account, in addition to the resource-level permissions.
4
Apply the principle of least privilege for encryption constraints.
Only grant `kms:GenerateDataKey` permission to the ECS task role, omitting `kms:Decrypt`.
This allows the ECS task to encrypt and write objects to S3 but prevents it from decrypting the assets once they are written.

Key Concept

Cross-account S3 bucket access with KMS CMK encryption
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic