Examkin

Question

Difficulty: HardSecurity Monitoring, Logging, and Compliance Auditing

A compliance auditor operating from an external AWS account (Account B) requires access to read consolidated AWS CloudTrail logs stored in an Amazon S3 bucket within the main corporate AWS account (Account A). The log files are encrypted with an AWS KMS customer managed key in Account A. The SysOps Administrator has attached an IAM policy to the auditor's IAM role in Account B that permits s3:GetObject on the S3 bucket and kms:Decrypt on the KMS key. The S3 bucket policy in Account A has also been updated to allow access from the auditor's role in Account B. However, when the auditor attempts to retrieve a log file, they receive an Access Denied error. Which action must the SysOps Administrator perform to resolve this issue?

  1. A
    Configure a bucket policy on the S3 bucket in Account A to grant kms:Decrypt permissions directly to the auditor's IAM role in Account B.
  2. B
    Add the iam:PassRole permission to the auditor's IAM role in Account B, specifying the ARN of the KMS key in Account A as the resource.
  3. Update the key policy of the KMS key in Account A to allow the auditor's IAM role in Account B to perform the kms:Decrypt action.Answer
  4. D
    Enable detailed monitoring on the CloudTrail trail in Account A to automatically propagate decryption credentials to Account B.

Answer

Update the key policy of the KMS key in Account A to allow the auditor's IAM role in Account B to perform the kms:Decrypt action.
For cross-account access to KMS-encrypted data, authorization must be granted by both the external identity's account and the resource owner's account. Because the customer managed key is in Account A and the auditor is in Account B, the KMS key policy in Account A must explicitly allow the auditor's IAM role ARN to perform the kms:Decrypt action. Once this key policy permission is in place, it works in tandem with the auditor's IAM policy in Account B to permit successful decryption.

Step-by-Step Solution

1
Identify that the access request is cross-account (Account B requesting access to resources in Account A).
Confirm that IAM policies in the destination account (Account B) cannot automatically grant access to resources in the source account (Account A) without resource-level permissions.
Cross-account authorization requires both the identity-based policy in the consuming account and the resource-based policy in the owning account to allow the action.
2
Evaluate the encryption configuration of the target files.
Observe that the CloudTrail logs are encrypted with a customer managed KMS key.
Accessing the encrypted objects requires both s3:GetObject permissions on the S3 bucket and kms:Decrypt permissions on the KMS key.
3
Examine the KMS key policy in Account A.
Determine that the KMS key policy does not explicitly permit the external auditor's role to decrypt.
By default, KMS key policies restrict access. Unlike S3 bucket policies where trust can sometimes be delegated purely via IAM, cross-account KMS access requires the key policy itself to explicitly trust the external IAM principal.
4
Update the KMS key policy in Account A.
Include the ARN of the auditor's IAM role from Account B in the Principal element of a policy statement allowing the kms:Decrypt action.
This establishes the necessary trust in the key owner's account to allow the external IAM role to use the key.

Key Concept

Cross-account KMS key delegation and policy precedence
Estimated Time:2m 30s
Rate this question

Topics

Security Monitoring, Logging, and Compliance Auditing

More questions from this topic