An enterprise manages its multi-account environment using AWS Organizations. Application servers running in several member accounts write transaction audit files to local Amazon S3 buckets. To comply with new data retention regulations, the company must aggregate these audit files into a centralized Amazon S3 bucket in a dedicated Security account. The files must be encrypted at rest using a customer managed key (CMK) that is rotated annually. The Security account must have sole ownership of all aggregated objects, and the solution must enforce minimum privilege and minimize operational overhead. Which combination of actions will meet these compliance requirements?
- AIn the Security account, create an S3 bucket with S3 Object Ownership set to Bucket Owner Enforced. Enable default bucket encryption using the AWS managed key for Amazon S3 (aws/s3). Configure the S3 bucket policy to grant s3:PutObject access to the organization's member accounts using the aws:PrincipalOrgID condition. In the member accounts, update the application IAM roles to allow writing to the Security account's S3 bucket and utilizing the AWS managed key (aws/s3) for encryption.
- In the Security account, create an S3 bucket with S3 Object Ownership set to Bucket Owner Enforced. Create a customer managed KMS key in the Security account with rotation enabled, and configure its key policy to grant the organization's member accounts access to kms:GenerateDataKey and kms:Decrypt actions. In the Security account, configure the S3 bucket policy to allow s3:PutObject access to the organization's principal org ID (aws:PrincipalOrgID). In the member accounts, ensure the application IAM roles have permissions to use the Security account's KMS key and write to the Security account's S3 bucket.Answer
- CIn the Security account, create an S3 bucket and a customer managed KMS key with rotation enabled. Create a Service Control Policy (SCP) at the Organization root that allows member accounts to perform kms:GenerateDataKey, kms:Decrypt, and s3:PutObject actions against the Security account's KMS key and S3 bucket. In the Security account, configure the S3 bucket policy to allow writing from the member accounts, and configure the application roles in the member accounts to use the KMS key.
- DIn the Security account, create an S3 bucket with S3 Object Ownership set to Bucket Owner Preferred, and create a customer managed KMS key with rotation enabled. Configure the KMS key policy to grant the organization's member accounts access. Configure the S3 bucket policy to allow s3:PutObject access from the member accounts' roles, but omit the aws:PrincipalOrgID condition or any principal restrictions. Have the applications in the member accounts write objects without specifying an access control list (ACL).
Answer
The correct answer specifies creating a centralized S3 bucket in the Security account with S3 Object Ownership set to Bucket Owner Enforced, using a customer managed key (CMK) with rotation enabled whose key policy grants access to the member accounts, and configuring the S3 bucket policy with the aws:PrincipalOrgID condition to restrict access to the organization.
The correct option addresses all compliance requirements securely. Setting S3 Object Ownership to 'Bucket Owner Enforced' disables ACLs and automatically transfers ownership of all cross-account writes to the Security account. Using a customer managed KMS key is required since AWS managed keys (such as aws/s3) cannot be shared across accounts. The KMS key policy and S3 bucket policy in the Security account must explicitly delegate access to the member accounts (via the aws:PrincipalOrgID condition), and the local application roles must have permissions to utilize both the bucket and the key.
Step-by-Step Solution
Key Concept
Cross-Account S3 Object Ownership and KMS Customer Managed Key Policy Management
Estimated Time:3m 0s