Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

A healthcare enterprise is designing a new patient monitoring application. The application runs on Amazon ECS tasks inside a Data Ingestion account (Account 123456789012) and must write clinical telemetry files directly to an Amazon S3 bucket in a Centralized Analytics account (Account 987654321098). The S3 bucket is encrypted using server-side encryption with AWS KMS (SSE-KMS). To comply with HIPAA requirements, the encryption keys must be managed in the Centralized Analytics account. Which combination of configurations must the Solutions Architect implement to allow the ECS tasks to write to the S3 bucket?

  1. In the Centralized Analytics account, create a Customer Managed Key (CMK) and configure its key policy to grant the Data Ingestion account root principal (arn:aws:iam::123456789012:root) permissions for kms:GenerateDataKey and kms:Decrypt. In the Centralized Analytics account, configure the S3 bucket policy to allow the ECS task's IAM role s3:PutObject permissions. In the Data Ingestion account, attach an IAM policy to the ECS task's IAM role that grants permissions for s3:PutObject on the Centralized Analytics S3 bucket, and kms:GenerateDataKey and kms:Decrypt on the CMK.Answer
  2. B
    In the Centralized Analytics account, configure default S3 bucket encryption using the AWS managed KMS key (aws/s3). Configure the S3 bucket policy to allow the ECS task's IAM role in the Data Ingestion account s3:PutObject permissions. In the Data Ingestion account, attach an IAM policy to the ECS task's IAM role that grants permissions for s3:PutObject on the Centralized Analytics S3 bucket, and kms:GenerateDataKey and kms:Decrypt on the aws/s3 key.
  3. C
    In the Centralized Analytics account, create a Customer Managed Key (CMK) and configure its key policy to trust the Data Ingestion account root principal (arn:aws:iam::123456789012:root) for KMS actions. In the Centralized Analytics account, configure the S3 bucket policy to allow the ECS task's IAM role s3:PutObject permissions. In the Data Ingestion account, attach a Service Control Policy (SCP) to the Organizational Unit containing the Data Ingestion account that grants s3:PutObject and kms:GenerateDataKey permissions for the Centralized Analytics account resources.
  4. D
    In the Centralized Analytics account, create a Customer Managed Key (CMK) and configure its key policy to grant the ECS task's IAM role in the Data Ingestion account permissions for kms:GenerateDataKey and kms:Decrypt. In the Centralized Analytics account, configure the S3 bucket policy to allow s3:PutObject permissions to the organization. In the Data Ingestion account, omit S3 and KMS permissions from the ECS task's IAM role policy, relying on the S3 bucket policy to delegate these permissions to the ECS tasks.

Answer

The configuration utilizing a Customer Managed Key (CMK) with a key policy delegating to the source account's root principal, an S3 bucket policy in the destination account allowing the write operations, and a local IAM policy in the source account granting the ECS task permissions to both the S3 bucket and KMS key.
The configuration utilizing a Customer Managed Key (CMK) with a key policy delegating to the source account's root principal, an S3 bucket policy in the destination account allowing the write operations, and a local IAM policy in the source account granting the ECS task permissions to both the S3 bucket and KMS key is correct. This configuration establishes a secure trust relationship that adheres to the two-way authorization model required for cross-account resource access in AWS.

Step-by-Step Solution

1
Select the correct key type
Identify that a Customer Managed Key (CMK) must be used in the Centralized Analytics account because AWS managed keys (aws/s3) cannot be shared cross-account.
AWS managed keys have default policies that cannot be modified to grant access to external accounts.
2
Configure destination account policies
Create a KMS key policy that grants the source account root principal (arn:aws:iam::123456789012:root) access to the CMK for cryptographic operations, and configure the S3 bucket policy to allow the ECS task's IAM role to perform s3:PutObject.
KMS key policies must explicitly trust the external account to delegate permissions, and the S3 bucket policy must allow the cross-account write.
3
Configure source account policies
Attach an IAM policy to the ECS task's IAM role in the Data Ingestion account that grants s3:PutObject on the destination S3 bucket and kms:GenerateDataKey/kms:Decrypt on the CMK in the Centralized Analytics account.
Cross-account access requires explicit permission in the caller's local IAM policy, as resource-based policies alone cannot grant access across account boundaries without local authorization.

Key Concept

Cross-account access design with SSE-KMS requires co-ordination of three policy types: destination KMS key policies (using Customer Managed Keys), destination S3 bucket policies, and source IAM policies.
Estimated Time:2m 30s
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic