Examkin

Question

Difficulty: HardSecurity and Compliance Control Design

A financial technology company is designing a secure compliance monitoring solution for credit card transaction logs. The logs are generated by applications running on Amazon ECS tasks in a Production account (Account 111122223333). These logs must be stored in an Amazon S3 bucket located in a dedicated Compliance account (Account 444455556666). The compliance team requires that:

1. All logs must be encrypted at rest using a customer managed key (CMK) in AWS KMS that the compliance team controls and rotates.
2. Production application tasks must have permission to write logs directly to the S3 bucket and use the KMS key, but must not be able to read or delete any logs once written.
3. The S3 bucket policy must enforce that only encrypted logs are accepted, and all uploaded log objects must be owned by the Compliance account.

Which combination of actions should the solutions architect take to meet these security and compliance requirements? (Select TWO.)

  1. Create a customer managed KMS key in the Compliance account. Configure the KMS key policy to grant the ECS task role in the Production account permissions to perform kms:GenerateDataKey and kms:Decrypt actions.Answer
  2. In the Compliance account, configure the S3 bucket policy to allow s3:PutObject from the ECS task role in the Production account, and enable S3 Object Ownership with the Bucket Owner Enforced setting on the bucket.Answer
  3. C
    In the Compliance account, enable default bucket encryption using the AWS managed KMS key for Amazon S3 (aws/s3), and configure the Production account's ECS tasks to encrypt uploaded logs using this key.
  4. D
    Apply a Service Control Policy (SCP) to the Organizational Unit containing the Production account that grants the ECS task role s3:PutObject permissions on the Compliance S3 bucket, bypassing the need for a local IAM policy.
  5. E
    In the Compliance account, configure the S3 bucket policy to grant the Production account root principal write access, and rely on the S3 bucket's default ACLs to grant the Compliance account access to the uploaded log objects.

Answer

Create a customer managed KMS key in the Compliance account with permissions for the Production ECS task role to generate a data key and decrypt, and configure the S3 bucket policy to allow writes while enabling Bucket Owner Enforced for S3 Object Ownership.
To design a secure compliance monitoring solution that meets all requirements, the solutions architect must use a Customer Managed Key (CMK) in the Compliance account and configure its key policy to allow the Production account's ECS task role to perform `kms:GenerateDataKey` and `kms:Decrypt`. AWS-managed keys cannot be shared cross-account. Additionally, S3 Object Ownership must be configured with Bucket Owner Enforced on the S3 bucket to disable ACLs and ensure that all cross-account uploaded objects are automatically owned by the Compliance account. The S3 bucket policy must also explicitly allow the `s3:PutObject` action from the ECS task role.

Step-by-Step Solution

1
Address the KMS encryption requirement for cross-account access.
Create a Customer Managed Key (CMK) in the Compliance account (destination) and configure its key policy to allow the Production account's ECS task role access to generate data keys and decrypt.
AWS-managed KMS keys cannot be shared cross-account, so a Customer Managed Key is required.
2
Configure S3 Object Ownership to transfer ownership to the Compliance account.
Set S3 Object Ownership to Bucket Owner Enforced on the destination bucket in the Compliance account.
This disables ACLs on the bucket and automatically makes the Compliance account the owner of all uploaded files, avoiding cross-account ownership issues.
3
Allow the ECS task role to write to the S3 bucket.
Add an S3 bucket policy in the Compliance account that grants s3:PutObject permissions to the specific ECS task role ARN from the Production account.
Cross-account access requires explicit permission in both the local IAM policy (sender) and the resource-based bucket policy (receiver).

Key Concept

Cross-account security controls involving S3 bucket policies, KMS Customer Managed Keys, and S3 Object Ownership configuration.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic