Examkin

Question

Difficulty: Very hardStrengthening Identity, Access, and Network Security

An enterprise is strengthening the security posture of an existing data processing application. The application runs on Amazon ECS Fargate tasks in a private subnet within VPC A (Account A). The tasks process telemetry data and write the results to a centralized Amazon S3 bucket in Account B. The S3 bucket is configured with default encryption using an AWS KMS Customer Managed Key (CMK) in Account B.

Currently, the ECS tasks access the S3 bucket via an S3 Gateway VPC Endpoint in VPC A. The security team must implement the following improvements:
- Ensure all data upload requests to the S3 bucket and KMS cryptographic requests are kept off the public internet.
- Restrict the S3 bucket and KMS CMK access so that they only accept requests originating from VPC A's VPC endpoints.
- Prevent administrators in Account A from modifying the KMS key policies or S3 bucket policies in Account B, while ensuring Account B security administrators retain full management capabilities.

Which combination of actions will meet these security requirements with the least operational complexity?

  1. Create a KMS Interface VPC Endpoint in VPC A. Update the S3 bucket policy in Account B to allow write permissions for the ECS task IAM role, with a condition restricting access to the S3 Gateway VPC Endpoint ID. Update the KMS CMK key policy in Account B to allow cryptographic permissions for the ECS task IAM role, with a condition restricting access to the KMS Interface VPC Endpoint ID. Rely on the default AWS cross-account security boundaries to restrict Account A administrators.Answer
  2. B
    Create a KMS Interface VPC Endpoint in VPC A. Update the S3 bucket policy and the KMS CMK key policy in Account B to allow access from the ECS task IAM role, with a condition restricting both resources to the S3 Gateway VPC Endpoint ID. Apply a Service Control Policy (SCP) to the Production OU containing Account A that denies policy modifications for S3 and KMS to protect Account B's resources.
  3. C
    Create an S3 Interface VPC Endpoint in VPC A to replace the S3 Gateway VPC Endpoint. Modify the default S3 AWS-managed KMS key (aws/s3) policy in Account B to grant cryptographic permissions to Account A's ECS task IAM role, restricted by a condition for the S3 Interface VPC Endpoint ID. Apply a Service Control Policy (SCP) to Account B's OU to block any policy modification requests originating from Account A IAM roles.
  4. D
    Create a KMS Interface VPC Endpoint in VPC A. Create a Route 53 Private Hosted Zone for the KMS service endpoint in Account B without associating it with VPC A. Update the S3 bucket policy in Account B to allow write permissions for the ECS task IAM role, with a condition restricting access to VPC A's ID. Update the KMS CMK key policy in Account B to allow cryptographic permissions for the ECS task IAM role, with a condition restricting access to the S3 Gateway VPC Endpoint ID.

Answer

Create a KMS Interface VPC Endpoint in VPC A. Update Account B's S3 bucket policy and KMS CMK key policy to trust Account A's ECS task IAM role, using the condition key aws:sourceVpce restricted to the S3 Gateway Endpoint ID and the KMS Interface Endpoint ID, respectively. Prevent Account A administrators from modifying Account B's resources by relying on standard AWS cross-account boundaries.
The correct answer provides a secure architecture that uses a KMS Interface VPC Endpoint in VPC A to ensure KMS API calls stay off the public internet, and restricts access to both S3 and KMS using the aws:sourceVpce condition key in the S3 bucket policy and KMS key policy. It also correctly relies on default AWS account boundaries, as Account A administrators have no native access to modify policies in Account B.

Step-by-Step Solution

1
Address the network path requirement for KMS by creating a KMS Interface VPC Endpoint in VPC A.
KMS cryptographic requests from the ECS tasks in VPC A can be routed privately within the AWS network without traversing the public internet.
AWS KMS does not support Gateway VPC Endpoints, so an Interface VPC Endpoint (PrivateLink) must be used to ensure private connectivity.
2
Configure S3 bucket policy restrictions in Account B using the S3 Gateway Endpoint ID.
The S3 bucket policy allows writes from Account A's ECS tasks only when requests originate from VPC A's S3 Gateway Endpoint.
Using the aws:sourceVpce condition key with the S3 Gateway Endpoint ID enforces that S3 write operations are strictly routed through VPC A's endpoint.
3
Configure the KMS Customer Managed Key policy in Account B to grant access to the ECS task IAM role, restricted by the KMS Interface VPC Endpoint ID.
ECS tasks can call KMS APIs to generate data keys for uploading data, but only when requests originate from the KMS Interface VPC Endpoint.
Since the bucket is encrypted with SSE-KMS using a Customer Managed Key, the client must have permissions to the KMS key. Restricting this using the KMS Interface VPC Endpoint ID ensures the cryptographic operations remain private.
4
Evaluate administrative control requirements for the policies in Account B.
No Service Control Policy (SCP) or extra IAM configuration is required to block Account A admins from modifying Account B's policies.
Default AWS cross-account security boundaries prevent administrators in one account from modifying policies or resources in another account unless explicit cross-account administration roles are created and assumed.

Key Concept

Strengthening identity and network security in a hybrid, cross-account architecture involves combining VPC Interface and Gateway Endpoints with resource-based policies (S3 bucket and KMS key policies) restricted by condition keys like aws:sourceVpce, while understanding that AWS account boundaries natively isolate resource management.
Rate this question

Topics

Strengthening Identity, Access, and Network Security