Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

A research organization is designing a genomic data processing platform. The processing applications run on Amazon EC2 instances in a dedicated Computation Account (Account A). The raw genome sequencing output files must be written directly to an Amazon S3 bucket located in a central Data Archive Account (Account B).

The organization's security policy requires:
- All data stored in the S3 bucket must be encrypted at rest using SSE-KMS with a Customer Managed Key (CMK) managed by the Data Archive Account (Account B).
- The Data Archive Account must maintain full ownership of all uploaded objects, and access control lists (ACLs) must be completely disabled.
- The EC2 instances in Account A must have the minimum necessary permissions to perform the uploads.

Which combination of configuration steps will meet these security requirements?

  1. In Account B, configure S3 Object Ownership to Bucket Owner Enforced. Modify the KMS CMK key policy to grant the EC2 instance role in Account A permissions for kms:GenerateDataKey and kms:Decrypt. Configure the S3 bucket policy to allow s3:PutObject for the EC2 instance role in Account A. In Account A, assign an IAM policy to the EC2 instances that allows s3:PutObject on the bucket in Account B and kms:GenerateDataKey on the KMS CMK in Account B.Answer
  2. B
    In Account B, configure S3 Object Ownership to Bucket Owner Enforced and set the bucket's default encryption to use the AWS managed key (aws/s3). Configure the S3 bucket policy to allow s3:PutObject for the EC2 instance role in Account A. In Account A, assign an IAM policy to the EC2 instances that allows s3:PutObject on the bucket in Account B.
  3. C
    In Account B, configure S3 Object Ownership to Bucket Owner Preferred. Modify the KMS CMK key policy to grant the EC2 instance role in Account A permissions for kms:GenerateDataKey and kms:Decrypt. Configure the S3 bucket policy to allow s3:PutObject for the EC2 instance role in Account A. In Account A, assign an IAM policy to the EC2 instances that allows s3:PutObject and specifies the bucket-owner-full-control canned ACL during upload.
  4. D
    In Account B, configure S3 Object Ownership to Bucket Owner Enforced. In the AWS Organizations management account, attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account A and Account B that allows s3:PutObject on the bucket and kms:GenerateDataKey on the KMS CMK. In Account A, assign an IAM policy to the EC2 instances that allows s3:PutObject on the bucket in Account B.

Answer

In Account B, configure S3 Object Ownership to Bucket Owner Enforced. Modify the KMS CMK key policy to grant the EC2 instance role in Account A permissions for kms:GenerateDataKey and kms:Decrypt. Configure the S3 bucket policy to allow s3:PutObject for the EC2 instance role in Account A. In Account A, assign an IAM policy to the EC2 instances that allows s3:PutObject on the bucket in Account B and kms:GenerateDataKey on the KMS CMK in Account B.
The correct option addresses all security requirements by using a Customer Managed Key (CMK) whose key policy can be modified to grant the necessary KMS permissions to the external IAM role in Account A. Setting S3 Object Ownership to Bucket Owner Enforced disables ACLs completely and automatically assigns ownership of all uploaded objects to Account B. S3 bucket policies and IAM policies are correctly configured to allow the cross-account s3:PutObject operation.

Step-by-Step Solution

1
Disable ACLs and enforce bucket owner ownership in the target account.
S3 Object Ownership in the Data Archive Account (Account B) is set to Bucket Owner Enforced, disabling ACLs and ensuring all uploaded files are owned by the bucket owner.
Meets the requirement to maintain full ownership of all objects and completely disable ACLs.
2
Configure cross-account KMS permissions on the Customer Managed Key (CMK) in Account B.
The KMS key policy in Account B is updated to permit the IAM role from Account A to perform kms:GenerateDataKey and kms:Decrypt operations.
Allows the external account's role to generate data keys for encrypting files uploaded to the S3 bucket using the target KMS key.
3
Configure the S3 bucket policy in Account B and IAM role policy in Account A.
The S3 bucket policy in Account B allows s3:PutObject for the role in Account A. The IAM policy of the role in Account A allows s3:PutObject on the bucket in Account B and kms:GenerateDataKey on the KMS CMK in Account B.
Grants the necessary S3 and KMS permissions across the account boundary for a successful write operation.

Key Concept

Cross-account Amazon S3 uploads with SSE-KMS encryption and Bucket Owner Enforced object ownership
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic