Examkin

Question

Difficulty: MediumCentralized Monitoring, Logging, and Auditing Solutions

A company manages 3030 member accounts within a single organization in AWS Organizations. The security team is setting up AWS Config in all member accounts and wants to centralize all configuration history files and snapshots into a single Amazon S3 bucket located in a dedicated Security Archive account. They want to encrypt all configuration data in the S3 bucket using a Customer Managed Key (CMK) in AWS KMS. Which configuration combination will allow AWS Config to successfully deliver the files to the S3 bucket?

  1. In the Security Archive account, configure the S3 bucket policy to allow s3:PutObject and s3:GetBucketAcl for the config.amazonaws.com service principal, conditioned on the organization ID. Create a KMS CMK in the Security Archive account, and configure its key policy to allow config.amazonaws.com to perform kms:GenerateDataKey* and kms:Decrypt, conditioned on the organization ID. In the member accounts, point AWS Config to the central S3 bucket and the KMS CMK ARN.Answer
  2. B
    In the Security Archive account, configure the S3 bucket policy to allow s3:PutObject and s3:GetBucketAcl for the config.amazonaws.com service principal, conditioned on the organization ID. Configure AWS Config in the member accounts to use the central S3 bucket and select the default AWS-managed KMS key for Amazon S3 (aws/s3) for encryption.
  3. C
    In the Security Archive account, create a KMS CMK and configure its key policy to allow config.amazonaws.com to perform kms:GenerateDataKey* and kms:Decrypt, conditioned on the organization ID. Configure the S3 bucket policy to allow the IAM roles associated with AWS Config in each member account to perform s3:PutObject and s3:GetBucketAcl, without allowing the config.amazonaws.com service principal.
  4. D
    Attach a Service Control Policy (SCP) to the organization root that grants s3:PutObject permissions on the central S3 bucket and kms:GenerateDataKey* permissions on the KMS key to the config.amazonaws.com service principal across all accounts. Enable default S3 encryption in the Security Archive account using an AWS-managed key, relying on the SCP to authorize cross-account delivery.

Answer

In the Security Archive account, configure the S3 bucket policy to allow s3:PutObject and s3:GetBucketAcl for the config.amazonaws.com service principal, conditioned on the organization ID. Create a KMS CMK in the Security Archive account, and configure its key policy to allow config.amazonaws.com to perform kms:GenerateDataKey* and kms:Decrypt, conditioned on the organization ID. In the member accounts, point AWS Config to the central S3 bucket and the KMS CMK ARN.
The correct answer configuration successfully authorizes cross-account delivery by targeting the config.amazonaws.com service principal in both the S3 bucket policy and the KMS Customer Managed Key (CMK) policy. Because AWS Config uses the service principal rather than member account IAM roles to perform delivery, and because AWS-managed keys cannot be used for cross-account encryption, a Customer Managed Key (CMK) in the central account with explicit service principal trust is the only valid solution.

Step-by-Step Solution

1
Determine key requirements for cross-account KMS encryption.
Identify that a Customer Managed Key (CMK) is mandatory because AWS-managed keys cannot be shared across accounts.
AWS-managed keys have fixed key policies that cannot be modified to grant cross-account permissions.
2
Configure the resource-based access policy for the central S3 bucket.
Grant s3:PutObject and s3:GetBucketAcl to the config.amazonaws.com service principal.
AWS Config delivers configuration history using the service principal directly rather than assuming the member account's IAM role.
3
Configure the key policy for the central KMS CMK.
Grant kms:GenerateDataKey* and kms:Decrypt permissions to the config.amazonaws.com service principal.
AWS Config requires these permissions to generate data keys for encrypting the log objects before writing them to the S3 bucket.

Key Concept

Centralized cross-account resource delivery with AWS Config, S3, and KMS Customer Managed Keys
Estimated Time:2m 0s
Rate this question

Topics

Centralized Monitoring, Logging, and Auditing Solutions

More questions from this topic