Question

Difficulty: EasyAWS Key Management Service (KMS) and Data Encryption

An organization has a data sharing requirement where users in a secondary AWS account must access encrypted files stored in an Amazon S3 bucket in a primary AWS account. The files are currently encrypted using the default AWS managed key (`aws/s3`) in the primary account.

Which configuration change is required to allow the users in the secondary account to decrypt these files?

  1. A
    Modify the key policy of the AWS managed key (`aws/s3`) in the primary account to grant access to the secondary account.
  2. B
    Create an IAM policy in the secondary account that grants decrypt permissions to the primary account's AWS managed key (`aws/s3`).
  3. Re-encrypt the files using a customer managed key and allow the secondary account to use the key in its key policy.Answer
  4. D
    Configure the S3 bucket policy in the primary account to delegate decrypt permissions for the AWS managed key (`aws/s3`) to the secondary account.

Answer

Re-encrypt the files using a customer managed key and allow the secondary account to use the key in its key policy.
The correct answer is to re-encrypt the files using a customer managed key. AWS managed keys (such as `aws/s3`) have default key policies that cannot be modified. Because cross-account access to KMS-encrypted resources requires explicit authorization in the key policy of the owning account, you must use a customer managed key and configure its key policy to delegate access to the secondary account.

Step-by-Step Solution

1
Identify the encryption key type currently in use.
The files are encrypted using the AWS managed key (`aws/s3`).
AWS managed keys have fixed key policies that cannot be edited, making them incompatible with cross-account access requirements.
2
Select a customer managed key (CMK) instead.
Create a new customer managed key or use an existing one in the primary account.
Customer managed key policies can be modified to grant access to other AWS accounts.
3
Configure the key policy and re-encrypt the data.
Update the customer managed key policy to allow the secondary account to perform KMS operations, and re-encrypt the S3 objects with this key.
This establishes the necessary trust relationship and permissions for cross-account decryption.

Key Concept

AWS KMS cross-account sharing requires a customer managed key (CMK) because the policies of AWS managed keys cannot be modified to delegate permissions to external accounts.
Rate this question