Examkin

Question

Difficulty: Very hardEnhancing Data Protection and Compliance

An automotive company operates an IoT connected vehicle platform that transmits real-time telemetry data, location records, and vehicle diagnostic logs from vehicles to an Amazon S3 bucket in a Production AWS account. Due to new industry compliance mandates, the company must enhance data protection and auditability for this platform.

The solutions architect must implement a security solution that satisfies the following requirements:
- All telemetry data written to the S3 bucket must be encrypted at rest using an AWS KMS key that is rotated annually.
- Key management must be strictly segregated: the security team in a separate Central Security AWS account must control the KMS key and its policy, while the application in the Production account must only be granted permission to encrypt and decrypt the telemetry files.
- Access to the telemetry files must be audited. Any unauthorized access attempts must trigger an immediate notification.
- The telemetry data must remain completely immutable and protected against deletion or modification by any user, including the root user, for a retention period of 7 years.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create a Customer Managed Key (CMK) in the Central Security account with key rotation enabled. Update the CMK key policy in the Central Security account to grant kms:GenerateDataKey and kms:Decrypt permissions to the application's IAM role in the Production account. In the Production account, configure the application's IAM role with a policy allowing these same KMS actions on the Central Security account's CMK ARN, and configure the S3 bucket to use this key for default encryption.Answer
  2. Enable versioning on the S3 bucket and configure S3 Object Lock in compliance mode with a retention duration of 7 years. Configure AWS CloudTrail to log data events for the S3 bucket, and create an Amazon EventBridge rule that filters for S3 API call errors containing AccessDenied, triggering an Amazon SNS topic to notify the security team.Answer
  3. C
    Configure the S3 bucket in the Production account to use the default AWS managed S3 KMS key (aws/s3). In the Central Security account, create an IAM policy that delegates cross-account access to the Production application's IAM role, and configure the key policy of the AWS managed key to trust the Production account.
  4. D
    Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level containing the Production account that explicitly grants kms:GenerateDataKey and kms:Decrypt permissions on the Central Security account's KMS key to the application's IAM role, and rely on this SCP to authorize the cross-account access.
  5. E
    Enable versioning and configure S3 Object Lock in governance mode on the S3 bucket. Create an S3 bucket policy in the Production account that allows only the Central Security account's root user to bypass retention policies and delete previous object versions, while blocking all other users.

Answer

Create a Customer Managed Key (CMK) in the Central Security account with key rotation enabled, updating the key policy to delegate access to the Production application's IAM role, and configure the Production IAM role with matching permissions. Additionally, enable S3 versioning and S3 Object Lock in compliance mode with a 7-year retention period, and configure CloudTrail data events with EventBridge rules to alert on AccessDenied errors.
To establish cross-account encryption while maintaining segregation of duties, a Customer Managed Key (CMK) must be created in the Central Security account. The key policy must delegate access to the Production account's application IAM role, and the application's IAM role must also have matching permissions. This satisfies the KMS cross-account access requirement. To enforce absolute immutability where no user (including root) can modify or delete data, versioning must be enabled alongside S3 Object Lock in compliance mode with a 7-year retention period. Monitoring unauthorized access is achieved by logging S3 data events in CloudTrail and using EventBridge rules to match 'AccessDenied' errors to trigger SNS notifications.

Step-by-Step Solution

1
Set up the KMS key configuration for cross-account access.
Create a Customer Managed Key (CMK) in the Central Security account, enable annual rotation, and configure the key policy to grant the Production application IAM role kms:GenerateDataKey and kms:Decrypt permissions.
AWS managed keys cannot be modified or shared cross-account; a CMK is required to delegate cross-account access.
2
Configure the client-side IAM policy in the Production account.
Attach an IAM policy to the application's IAM role in the Production account allowing kms:GenerateDataKey and kms:Decrypt on the CMK ARN in the Central Security account.
Cross-account access to KMS requires both the key policy and the local IAM identity policy to permit the action.
3
Configure data immutability using S3 Object Lock.
Enable S3 versioning on the Production telemetry bucket and configure S3 Object Lock in compliance mode for 7 years.
Compliance mode guarantees that no user, including the root account, can shorten the retention period or delete objects during the 7-year window.
4
Set up auditing and access alerting.
Enable CloudTrail logging for S3 data events on the telemetry bucket, and create an EventBridge rule matching AccessDenied errors that targets an SNS topic.
CloudTrail data events capture object-level operations, and EventBridge provides real-time alerting based on specific API failure modes.

Key Concept

Cross-Account KMS Key Delegation and Immutability Controls
Rate this question

Topics

Enhancing Data Protection and Compliance