An organization has a data sharing requirement where users in a secondary AWS account must access encrypted files stored in an Amazon S3 bucket in a primary AWS account. The files are currently encrypted using the default AWS managed key (`aws/s3`) in the primary account.
Which configuration change is required to allow the users in the secondary account to decrypt these files?
- AModify the key policy of the AWS managed key (`aws/s3`) in the primary account to grant access to the secondary account.
- BCreate an IAM policy in the secondary account that grants decrypt permissions to the primary account's AWS managed key (`aws/s3`).
- Re-encrypt the files using a customer managed key and allow the secondary account to use the key in its key policy.Answer
- DConfigure the S3 bucket policy in the primary account to delegate decrypt permissions for the AWS managed key (`aws/s3`) to the secondary account.
Answer
Re-encrypt the files using a customer managed key and allow the secondary account to use the key in its key policy.
The correct answer is to re-encrypt the files using a customer managed key. AWS managed keys (such as `aws/s3`) have default key policies that cannot be modified. Because cross-account access to KMS-encrypted resources requires explicit authorization in the key policy of the owning account, you must use a customer managed key and configure its key policy to delegate access to the secondary account.
Step-by-Step Solution
Key Concept
AWS KMS cross-account sharing requires a customer managed key (CMK) because the policies of AWS managed keys cannot be modified to delegate permissions to external accounts.