Examkin

Question

Difficulty: HardS3 Reliability and Replication

A SysOps Administrator is configuring cross-account Amazon S3 Same-Region Replication (SRR) between a source bucket in Account A and a destination bucket in Account B. The source bucket contains objects encrypted with a customer managed AWS KMS key in Account A. The administrator creates an IAM replication role in Account A and configures the replication rule on the source bucket, but the objects fail to replicate to the destination bucket. Which two configurations are required to resolve this issue? (Select two.)

  1. Configure the replication rule to enable replication of KMS-encrypted objects, and grant the replication IAM role decrypt permissions for the customer managed KMS key in Account A.Answer
  2. Grant the replication IAM role in Account A encrypt permissions on the KMS key in Account B, and update the Account B key policy to trust the replication IAM role.Answer
  3. C
    Suspend versioning on the destination bucket in Account B to allow replication without generating new object versions.
  4. D
    Add the iam:PassRole permission to the replication IAM role's permissions policy to allow it to pass credentials to the destination bucket.
  5. E
    Modify the destination KMS key policy in Account B to grant encrypt permissions directly to the source bucket's Amazon Resource Name (ARN).

Answer

To resolve the replication failure, the replication rule must be configured to replicate KMS-encrypted objects with decrypt permissions for the source KMS key, and the replication IAM role must be granted encrypt permissions on the destination KMS key along with an updated key policy in the destination account.
To replicate objects encrypted with a customer managed KMS key, replication of KMS-encrypted objects must be explicitly enabled in the replication rule, and the replication IAM role must have decrypt permissions for the source KMS key. Additionally, because the destination bucket is in a different account, the replication IAM role needs permissions to encrypt objects using the destination KMS key, and the destination KMS key policy in Account B must be updated to trust the replication IAM role in Account A.

Step-by-Step Solution

1
Enable KMS-encrypted object replication in the replication rule.
Amazon S3 will attempt to replicate KMS-encrypted objects.
By default, S3 replication does not replicate objects encrypted with AWS KMS customer managed keys.
2
Grant the replication IAM role decrypt permissions on the source KMS key.
The replication role can decrypt the source objects to replicate them.
The S3 replication service requires access to decrypt the source objects before it can copy them.
3
Grant the replication IAM role encrypt permissions on the destination KMS key and update the key policy in Account B.
The replication role can encrypt objects using the KMS key in the destination account.
For cross-account replication with KMS, the source replication role needs cross-account permissions to use the destination KMS key, which requires both IAM permission and destination key policy permission.

Key Concept

Cross-account S3 replication with KMS encrypted objects requires explicit replication configuration enablement, source decrypt permissions, and destination cross-account encrypt permissions on the respective KMS keys.
Rate this question

Topics

S3 Reliability and Replication

More questions from this topic