Examkin

Question

Difficulty: Very hardSecurity and Compliance Control Design

An enterprise is building a centralized compliance monitoring platform. A scanning application runs on Amazon ECS tasks in a dedicated Security Operations account (Account ID: 111122223333). The ECS tasks are configured to use the task role arn:aws:iam::111122223333:role/SecurityScannerRole. The scanning application must retrieve and analyze configuration audit logs stored in an Amazon S3 bucket in a Production member account (Account ID: 444455556666). The audit logs are encrypted at rest using a Customer Managed Key (CMK) in AWS KMS located in Account ID 444455556666. A Service Control Policy (SCP) is applied at the root of the AWS Organization that allows S3 and KMS actions. Which combination of actions must the Solutions Architect take to enable the scanning application to access and decrypt the audit logs? (Select TWO.)

  1. In the Production member account, modify the S3 bucket policy to allow the SecurityScannerRole IAM role to perform the s3:GetObject and s3:ListBucket actions, and modify the KMS key policy of the CMK to grant the SecurityScannerRole IAM role permissions to perform the kms:Decrypt and kms:DescribeKey actions.Answer
  2. In the Security Operations account, attach an IAM policy to the SecurityScannerRole IAM role that grants permissions to perform the s3:GetObject and s3:ListBucket actions on the S3 bucket in the Production account, and the kms:Decrypt and kms:DescribeKey actions on the KMS CMK in the Production account.Answer
  3. C
    In the Production member account, re-encrypt the logs using the default AWS-managed key for Amazon S3 (aws/s3) and modify the key policy of aws/s3 to delegate decrypt permissions to the Security Operations account.
  4. D
    In the organization's management account, attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the Production account that explicitly grants the SecurityScannerRole IAM role permissions to perform the s3:GetObject and kms:Decrypt actions.
  5. E
    In the Production member account, configure the trust policy of the KMS CMK to trust the Security Operations account's SAML identity provider using the sts:AssumeRoleWithSAML action to authorize cross-account decryption requests.

Answer

Configure the S3 bucket policy and KMS CMK key policy in the Production account to trust the SecurityScannerRole principal, and attach an IAM policy to the SecurityScannerRole in the Security Operations account allowing access to the external S3 bucket and KMS CMK resources.
To enable cross-account access to S3 objects encrypted with a Customer Managed Key (CMK), permissions must be allowed on both the caller side and the resource side. The option to configure the S3 bucket policy and the KMS key policy in the target Production account is correct because it establishes trust for the cross-account principal. The option to attach an IAM policy to the SecurityScannerRole in the Security Operations account is correct because it authorizes the role to make calls to external S3 and KMS resources.

Step-by-Step Solution

1
Examine resource-side encryption requirements
Identify that the S3 objects are encrypted with a Customer Managed Key (CMK) in the Production account, meaning both S3 bucket access and KMS decryption permission must be established.
When objects in S3 are encrypted with a CMK, cross-account access requires permissions for both the S3 APIs and the KMS decryption APIs.
2
Configure Production account resource policies
Add the SecurityScannerRole ARN to the S3 bucket policy (allowing s3:GetObject and s3:ListBucket) and to the KMS CMK key policy (allowing kms:Decrypt and kms:DescribeKey).
Since the caller is in another account, the target account's resource policies must explicitly trust the external IAM principal.
3
Configure Security Operations account IAM role policy
Attach an IAM policy to the SecurityScannerRole allowing s3:GetObject and s3:ListBucket on the external bucket, and kms:Decrypt and kms:DescribeKey on the external CMK.
An IAM role cannot interact with resources in external accounts unless its own account's IAM policy permits the cross-account call.

Key Concept

Cross-account access to encrypted S3 resources requires resource policies in the destination account (S3 bucket policy and KMS key policy) to trust the source principal, and the source principal's IAM policy to permit the external requests. AWS-managed keys cannot be shared cross-account.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic