Examkin

Question

Difficulty: HardIAM Policies, Roles, and Service Control Policies (SCPs)

A security auditing application runs on Amazon EC2 instances in a security account (222222222222) under an IAM role named `AuditorRole`. The application needs to retrieve audit logs stored in an Amazon S3 bucket located in a production account (111111111111). The S3 bucket is encrypted using a customer managed AWS KMS key in the production account. A SysOps administrator is configuring a cross-account IAM role named `ProdAccessRole` in the production account to grant the application access. The administrator has already configured the permissions policy for `ProdAccessRole` and the IAM permissions policy for `AuditorRole`. Which combination of actions is required to allow the auditing application to assume the role and decrypt the logs? (Select TWO.)

  1. Configure the trust policy of `ProdAccessRole` in the production account to allow the `sts:AssumeRole` action for the `AuditorRole` principal in the security account.Answer
  2. Configure the KMS key policy in the production account to grant the `ProdAccessRole` permissions to perform the `kms:Decrypt` action.Answer
  3. C
    Attach a permissions policy to `AuditorRole` in the security account that grants the `iam:PassRole` action on the `ProdAccessRole` resource in the production account.
  4. D
    Attach a permissions policy to `AuditorRole` in the security account that allows the `iam:PassRole` action on the customer managed KMS key resource in the production account.
  5. E
    Configure the trust policy of `ProdAccessRole` in the production account to trust the Amazon S3 service principal (`s3.amazonaws.com`) to assume the role on behalf of `AuditorRole`.

Answer

Configure the trust policy of `ProdAccessRole` in the production account to allow the `sts:AssumeRole` action for the `AuditorRole` principal in the security account, and configure the KMS key policy in the production account to grant the `ProdAccessRole` permissions to perform the `kms:Decrypt` action.
To establish cross-account access under least privilege, the target role (`ProdAccessRole`) in the production account must trust the specific security auditing role (`AuditorRole`) in the security account, allowing it to perform `sts:AssumeRole`. Additionally, since the S3 logs are encrypted with a customer managed KMS key, the KMS key policy in the production account must explicitly grant `kms:Decrypt` permissions to `ProdAccessRole` so that the assumed role session can successfully decrypt the read objects.

Step-by-Step Solution

1
Configure the cross-account trust relationship.
The trust policy of `ProdAccessRole` in the production account is updated to include Account B's `AuditorRole` as a trusted principal with permission to call `sts:AssumeRole`.
This allows the security application to authenticate and obtain temporary credentials for the production role.
2
Ensure the assumed role can access the encrypted logs.
The KMS key policy in the production account is updated to grant `kms:Decrypt` to `ProdAccessRole`.
For cross-account access and customer managed keys, IAM permissions alone are insufficient; the KMS key policy itself must authorize the decrypting principal.

Key Concept

Cross-account IAM role assumption combined with KMS key policy authorization
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic