Examkin

Question

Difficulty: MediumEnhancing Data Protection and Compliance

A logistics company utilizes a multi-account structure under AWS Organizations. Application workloads in various member accounts write sensitive delivery receipt logs to a centralized Amazon S3 bucket located in a dedicated Security account. The S3 bucket currently relies on Amazon S3 managed keys (SSE-S3) for default encryption. To comply with new industry regulations, the company must enforce encryption of all logs at rest using a customer-managed KMS key that is automatically rotated. Additionally, member accounts must only be permitted to encrypt objects during upload and must not have permission to decrypt the logs once written. What is the most secure configuration that achieves these requirements?

  1. Create a customer-managed KMS key in the Security account and enable annual rotation. Update the KMS key policy to grant the member account IAM roles permissions for kms:GenerateDataKey and kms:DescribeKey only. Configure the centralized S3 bucket to use this KMS key for default encryption. Apply a Service Control Policy (SCP) to the member accounts that denies the s3:PutEncryptionConfiguration permission and blocks S3 uploads that do not use SSE-KMS encryption.Answer
  2. B
    Configure the S3 bucket to use the AWS-managed KMS key for Amazon S3 (aws/s3) in the Security account. Authorize cross-account access by configuring an IAM policy in the member accounts that grants permissions for kms:GenerateDataKey on the Security account's AWS-managed key, and enforce SSE-KMS via an SCP.
  3. C
    Create a customer-managed KMS key in the Security account. Apply a Service Control Policy (SCP) to the member accounts that grants cross-account permissions for kms:GenerateDataKey and kms:DescribeKey on the Security account's KMS key, while denying kms:Decrypt. Configure the S3 bucket default encryption to use this KMS key.
  4. D
    Create a customer-managed KMS key in the Security account. Update the S3 bucket policy in the Security account to grant kms:GenerateDataKey and kms:DescribeKey permissions to the member account IAM roles. Configure the S3 bucket default encryption to use this KMS key, and apply an SCP to prevent member accounts from changing S3 default encryption settings.

Answer

Create a customer-managed KMS key in the Security account and enable annual rotation. Update the KMS key policy to grant the member account IAM roles permissions for kms:GenerateDataKey and kms:DescribeKey only. Configure the centralized S3 bucket to use this KMS key for default encryption. Apply a Service Control Policy (SCP) to the member accounts that denies the s3:PutEncryptionConfiguration permission and blocks S3 uploads that do not use SSE-KMS encryption.
The correct option correctly leverages a customer-managed KMS key in the Security account, which allows key policies to be adjusted for cross-account access. Since the logs must only be written (encrypted) by the member accounts, granting them only kms:GenerateDataKey and kms:DescribeKey prevents them from decrypting the files once they are uploaded. Furthermore, using a Service Control Policy (SCP) at the Organization level ensures that individual account administrators cannot alter S3 bucket encryption configurations.

Step-by-Step Solution

1
Configure AWS KMS Key in Security Account
A Customer Managed Key (CMK) is created with automatic annual rotation enabled. The key policy is modified to allow the member account's IAM roles the ability to use the key for encryption (kms:GenerateDataKey and kms:DescribeKey) but not decryption.
AWS-managed keys cannot be shared across accounts, meaning a Customer Managed Key is required. Restricting decryption permissions enforces the security constraint.
2
Configure Centralized S3 Bucket Default Encryption
The target S3 bucket's default encryption is updated to use the newly created customer-managed KMS key.
This guarantees that any log files written to the bucket are automatically encrypted at rest using the specified compliance key.
3
Deploy Service Control Policy (SCP) Guardrails
An SCP is attached to the member accounts restricting s3:PutEncryptionConfiguration and enforcing SSE-KMS headers on uploads.
This prevents local administrators in member accounts from bypassing the compliance policy or changing default encryption settings on the S3 bucket.

Key Concept

Cross-account AWS KMS key sharing paired with S3 bucket default encryption and Service Control Policy guardrails.
Estimated Time:2m 30s
Rate this question

Topics

Enhancing Data Protection and Compliance