Examkin

Question

Difficulty: Very hardSecurity and Compliance Control Design

A financial services company is launching a secure transactional platform across two AWS accounts. An application running on Amazon ECS tasks in the Trading Account (Account ID: `123456789012`) under the IAM Role `TradingEngineRole` must write historical transaction logs to an Amazon S3 bucket located in the Audit Account (Account ID: `987654321098`). The logs must be encrypted at rest using an AWS KMS key managed by the Audit team in the Audit Account. The key policy must strictly limit access to only the `TradingEngineRole` and cannot use a wildcard (`*`) principal. Which configuration will successfully allow the application to write the encrypted logs to the S3 bucket in the Audit Account while meeting all security requirements?

  1. Create a Customer Managed Key (CMK) in the Audit Account. Configure the KMS key policy to grant the `TradingEngineRole` ARN permissions for the `kms:GenerateDataKey` and `kms:Decrypt` actions. Configure the S3 bucket policy in the Audit Account to grant `s3:PutObject` permissions to the `TradingEngineRole` ARN. Configure the local IAM policy for the `TradingEngineRole` in the Trading Account to grant permissions for both the S3 bucket ARN and the KMS key ARN.Answer
  2. B
    Use the default AWS-managed KMS key for S3 (`aws/s3`) in the Audit Account. Configure the S3 bucket policy in the Audit Account to grant `s3:PutObject` permissions to the `TradingEngineRole` ARN. Configure the local IAM policy for the `TradingEngineRole` in the Trading Account to grant `kms:GenerateDataKey` permissions for the AWS-managed key ARN and `s3:PutObject` permissions for the S3 bucket.
  3. C
    Create a Customer Managed Key (CMK) in the Audit Account. Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the Trading Account that explicitly grants the `TradingEngineRole` ARN the `kms:GenerateDataKey` and `kms:Decrypt` permissions. Configure the S3 bucket policy in the Audit Account to grant `s3:PutObject` permissions to the `TradingEngineRole` ARN. Rely on the SCP to delegate the KMS permissions without configuring a local IAM policy in the Trading Account.
  4. D
    Create a Customer Managed Key (CMK) in the Audit Account. Configure the KMS key policy to grant the `TradingEngineRole` ARN permissions for the `kms:GenerateDataKey` and `kms:Decrypt` actions. Configure the local IAM policy for the `TradingEngineRole` in the Trading Account to grant permissions for both the S3 bucket ARN and the KMS key ARN. Do not configure an S3 bucket policy on the Audit Account's S3 bucket, assuming that because both accounts belong to the same AWS Organization, the IAM policy is sufficient to write to the bucket.

Answer

Create a Customer Managed Key (CMK) in the Audit Account. Configure the KMS key policy to grant the `TradingEngineRole` ARN permissions for the `kms:GenerateDataKey` and `kms:Decrypt` actions. Configure the S3 bucket policy in the Audit Account to grant `s3:PutObject` permissions to the `TradingEngineRole` ARN. Configure the local IAM policy for the `TradingEngineRole` in the Trading Account to grant permissions for both the S3 bucket ARN and the KMS key ARN.
The correct answer provides the necessary configuration for a successful cross-account encrypted upload to S3. Because the KMS key and the S3 bucket reside in the Audit Account while the writing application runs in the Trading Account, three layers of authorization are needed: the identity-based IAM policy in the Trading Account must allow access to the external resources; the KMS key policy must trust the Trading Account's IAM role; and the S3 bucket policy must trust the same IAM role. Additionally, a Customer Managed Key (CMK) is required because AWS-managed keys cannot be shared across account boundaries.

Step-by-Step Solution

1
Determine the type of KMS key required for cross-account S3 encryption.
Identify that a Customer Managed Key (CMK) is required because AWS-managed keys (like `aws/s3`) cannot have their key policies edited to allow access from external accounts.
AWS-managed keys have fixed key policies that cannot be modified for cross-account access.
2
Configure the key policy for the Customer Managed Key in the Audit Account.
Explicitly grant `kms:GenerateDataKey` and `kms:Decrypt` permissions to the specific IAM Role ARN (`arn:aws:iam::123456789012:role/TradingEngineRole`).
Cross-account KMS access requires the key policy to explicitly authorize the foreign IAM principal.
3
Configure the S3 bucket policy in the Audit Account.
Add a bucket policy statement allowing `s3:PutObject` with the principal set to the `TradingEngineRole` ARN.
For cross-account S3 access, the resource-based policy must explicitly authorize the external principal.
4
Configure the IAM policy for the role in the Trading Account.
Create a policy allowing `s3:PutObject` on the target S3 bucket ARN and `kms:GenerateDataKey` + `kms:Decrypt` on the KMS key ARN, and attach it to the `TradingEngineRole`.
Both the target resource policies (key policy and bucket policy) and the caller's identity-based policy (IAM policy) must allow the actions for cross-account access to succeed.

Key Concept

Cross-account access to S3 with KMS encryption requires explicit authorization on both the resource policies (S3 bucket policy and KMS key policy) and the identity-based policy (IAM policy) using a Customer Managed Key.
Rate this question

Topics

Security and Compliance Control Design

More questions from this topic