Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

A multinational financial enterprise is building a regulatory reporting data pipeline. The application tier runs on Amazon EC2 instances in an Application Account (Account A: 111122223333111122223333). The reporting logs must be delivered to an Amazon S3 bucket in a Centralized Security Account (Account B: 444455556666444455556666). The compliance requirements mandate that all logs must be encrypted at rest using a Key Management Service (KMS) key, and the Centralized Security Account must have full ownership of all uploaded objects to prevent access delegation issues. The application tier must only have permissions to write objects and must not be allowed to decrypt the logs once written. Which combination of actions must the solutions architect take to meet these security requirements? (Select TWO.)

  1. Enable S3 Object Ownership with the Bucket Owner Enforced setting on the S3 bucket in Account B, and configure the S3 bucket policy in Account B to grant s3:PutObject permissions to Account A's EC2 instance profile role.Answer
  2. Create a customer managed KMS key in Account B, configure its key policy to grant kms:GenerateDataKey permissions to Account A's EC2 instance profile role, and configure the S3 bucket in Account B to use this customer managed KMS key for default encryption.Answer
  3. C
    Enable default encryption on the destination S3 bucket in Account B using the default AWS managed key (aws/s3), and configure a Service Control Policy (SCP) in the organization to grant Account A cross-account access to the AWS managed key.
  4. D
    Configure the S3 bucket policy in Account B to grant s3:PutObject permissions to Account A's IAM role, and include kms:GenerateDataKey permissions within the S3 bucket policy to allow Account A to encrypt the objects.
  5. E
    Create an IAM role in Account B that has permissions to write to the S3 bucket and encrypt objects using the KMS key. Configure the role's trust policy to use the sts:AssumeRoleWithSAML action to allow the EC2 instances in Account A to assume the role.

Answer

Enable S3 Object Ownership with the Bucket Owner Enforced setting on the S3 bucket in Account B, configure the bucket policy to grant s3:PutObject permissions to Account A's role, and use a customer managed KMS key in Account B with key policy permissions for kms:GenerateDataKey granted to Account A.
To support cross-account KMS encryption, a customer managed key (CMK) must be created in the destination account because AWS managed keys (such as aws/s3) do not support policy modification and cannot be shared across accounts. Granting the writing role `kms:GenerateDataKey` allows the application to encrypt files without requiring `kms:Decrypt` access. Additionally, disabling S3 ACLs using the Bucket Owner Enforced setting ensures that all objects uploaded to the bucket are automatically owned by the bucket owner (the security account), resolving potential ownership and permission delegation issues.

Step-by-Step Solution

1
Address the cross-account encryption requirement by creating a customer managed key (CMK) in the destination security account (Account B).
A CMK is established which supports cross-account key policy delegation, unlike default AWS-managed KMS keys.
AWS-managed keys (e.g., aws/s3) cannot be shared across accounts as their policies are not editable.
2
Configure the key policy of the newly created CMK to allow Account A's EC2 instance profile role to generate data keys.
The application can perform encryption at write time by calling kms:GenerateDataKey without requiring decryption permissions.
Applying the principle of least privilege ensures the writing account cannot decrypt or read the logs once written.
3
Configure the destination S3 bucket in Account B with default encryption using the customer managed KMS key.
All objects uploaded to the bucket are automatically encrypted with the specified CMK.
Enforces compliance control for encryption at rest for all incoming reporting logs.
4
Enable the Bucket Owner Enforced setting under S3 Object Ownership on the bucket in Account B, and grant s3:PutObject permissions in the bucket policy to Account A's role.
S3 ACLs are disabled, and the Centralized Security Account (Account B) automatically owns all uploaded log objects.
Ensures that the security account maintains full control and ownership of the logs without relying on object ACLs from the writer account.

Key Concept

Designing cross-account security controls using KMS key policies and S3 Object Ownership (Bucket Owner Enforced) to maintain compliance and data ownership.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic