Examkin

Question

Difficulty: Very hardS3 Reliability and Replication

A SysOps Administrator is configuring cross-account, cross-region replication for an Amazon S3 bucket. The source bucket is in Account A (us-east-1) and contains objects encrypted with an AWS KMS customer managed key. The destination bucket is in Account B (us-west-2). The administrator has enabled versioning on the source bucket, created the replication configuration in Account A, and specified a new replication IAM role in Account A. However, the replication is failing, and no objects are appearing in the destination bucket. Which two actions must the administrator take to successfully replicate the KMS-encrypted objects?

  1. Enable bucket versioning on the destination bucket in Account B.Answer
  2. Modify the KMS key policy in Account B to grant the replication IAM role from Account A permissions to perform kms:GenerateDataKey and kms:Encrypt actions.Answer
  3. C
    Modify the replication IAM role in Account A to include iam:PassRole permissions targeting the S3 replication service principal.
  4. D
    Associate the destination bucket's subnet route table in Account B with an S3 Gateway Endpoint to authorize cross-account replication traffic.
  5. E
    Configure the replication rule to use the default AWSServiceRoleForS3Replication service-linked role to automatically inherit permissions for cross-account KMS key access.

Answer

Enable bucket versioning on the destination bucket in Account B, and modify the KMS key policy in Account B to grant the replication IAM role from Account A permissions to perform kms:GenerateDataKey and kms:Encrypt actions.
Replicating KMS-encrypted objects across accounts requires S3 versioning to be enabled on both the source and destination buckets, as S3 replication requires versioning to track and sync objects. Additionally, the replication IAM role in Account A must have permissions to encrypt objects in the destination bucket using Account B's KMS key. This is accomplished by updating the KMS key policy in Account B to grant kms:GenerateDataKey and kms:Encrypt permissions to the replication role in Account A.

Step-by-Step Solution

1
Enable versioning on the destination bucket in Account B.
Meets the core prerequisite that both source and destination buckets in an S3 replication setup must have versioning enabled.
S3 replication relies on versioning metadata to track and sync object states, so replication will fail if the destination bucket lacks versioning.
2
Update the KMS key policy for the destination key in Account B.
Grants the replication IAM role (from Account A) permission to encrypt objects at the destination using Account B's KMS key.
Since the replication role resides in Account A, the cross-account KMS key policy in Account B must explicitly permit that role to call kms:Encrypt and kms:GenerateDataKey.

Key Concept

Amazon S3 Cross-Account Replication with KMS Encryption
Rate this question

Topics

S3 Reliability and Replication

More questions from this topic