Examkin

Question

Difficulty: HardStrengthening Identity, Access, and Network Security

An enterprise has a multi-account AWS structure managed via AWS Organizations. The production account hosts an Amazon S3 bucket containing sensitive tracking telemetry. Applications running on Amazon EC2 instances in private subnets of spoke VPCs in separate member accounts need to write data to this bucket. The data must be encrypted at rest using a customer managed AWS KMS key in the production account, and network traffic must not traverse the public internet. Which combination of actions should the Solutions Architect implement to meet these requirements while adhering to the principle of least privilege? (Select TWO.)

  1. Create a Customer Managed Key (CMK) in the production account, and update its key policy to grant the IAM roles in the spoke accounts permission to perform the kms:GenerateDataKey and kms:Decrypt actions.Answer
  2. Deploy an Amazon S3 Gateway VPC Endpoint in each spoke VPC, and configure the S3 bucket policy in the production account to allow access from the spoke accounts' IAM roles only when the aws:sourceVpce condition matches these endpoints.Answer
  3. C
    Configure the S3 bucket to use the default AWS-managed KMS key (aws/s3) for encryption, and apply a Service Control Policy (SCP) at the Organizational Unit level to grant the spoke accounts permission to use this key.
  4. D
    Deploy a single Amazon S3 Gateway VPC Endpoint in the production VPC, and configure Transit Gateway route tables to forward all outbound S3 traffic from the spoke VPCs to the production VPC's gateway endpoint.
  5. E
    Create a resource share using AWS Resource Access Manager (RAM) to share the S3 bucket and the default KMS key with the spoke accounts, allowing direct cross-account access.

Answer

To securely allow applications in spoke VPCs to write to a centralized S3 bucket in a production account with encryption, a Customer Managed Key (CMK) must be created in the production account with a key policy that allows the spoke IAM roles to generate data keys and decrypt. Additionally, S3 Gateway VPC Endpoints must be created in each spoke VPC, and the production S3 bucket policy must restrict access to those specific VPC endpoints using the aws:sourceVpce condition.
The correct solution involves using a Customer Managed Key (CMK) because AWS-managed keys cannot be shared cross-account. Spoke VPCs can utilize local S3 Gateway Endpoints to route S3 traffic over the private AWS network, and the centralized S3 bucket policy must restrict access to those specific endpoints to ensure network-level isolation.

Step-by-Step Solution

1
Select the correct KMS key type for cross-account access.
Create a Customer Managed Key (CMK) in the production account and grant permissions to the spoke accounts in its key policy.
AWS-managed KMS keys (such as aws/s3) cannot be shared across accounts because their key policies cannot be modified. A Customer Managed Key is required.
2
Select the appropriate network path for S3 access from private subnets.
Deploy S3 Gateway VPC Endpoints in the spoke VPCs.
S3 Gateway Endpoints allow instances in private subnets to access S3 privately without internet egress. They are free and native to each VPC.
3
Enforce network-level access control on the S3 bucket.
Update the S3 bucket policy to restrict access to the spoke VPC endpoints using the aws:sourceVpce condition.
This ensures that traffic is only allowed when it originates from the specified private VPC endpoints, preventing public access or access from unauthorized networks.

Key Concept

Cross-account KMS sharing and private S3 network access using VPC endpoints.
Rate this question

Topics

Strengthening Identity, Access, and Network Security