Examkin

Soru

Zorluk: ZorAWS KMS and Encryption

An application running on Amazon ECS container instances in Account A needs to decrypt sensitive data files stored in an Amazon S3 bucket. The files are encrypted using an AWS KMS Customer Managed Key (CMK) located in Account B. The developer needs to configure the permissions to allow the application to decrypt these files.

Which of the following actions must be taken to grant the application the required permissions? (Choose two.)

  1. In Account B, update the KMS key policy of the CMK to grant the kms:Decrypt action to the application's IAM task role in Account A.Cevap
  2. In Account A, attach an IAM policy to the application's IAM task role that allows the kms:Decrypt action on the KMS key ARN in Account B.Cevap
  3. C
    In Account A, attach an IAM policy to the ECS task execution role that allows the kms:Decrypt action on the KMS key ARN in Account B.
  4. D
    In Account B, update the S3 bucket policy to grant kms:Decrypt permissions to the application's IAM task role in Account A.
  5. E
    In Account A, retrieve the KMS Customer Managed Key plaintext key material and store it as a SecureString in AWS Systems Manager Parameter Store.

Cevap

In Account B, update the KMS key policy of the CMK to grant the kms:Decrypt action to the application's IAM task role in Account A; and in Account A, attach an IAM policy to the application's IAM task role that allows the kms:Decrypt action on the KMS key ARN in Account B.
Cross-account access to KMS keys requires validation at both the resource level and the identity level. First, the key policy of the Customer Managed Key in Account B must be configured to trust the external account or role. Second, the IAM policy in the application's account (Account A) must grant the application's IAM role permission to call the KMS API. Because the application logic runs within ECS containers, these permissions must be applied to the ECS Task Role.

Adım Adım Çözüm

1
Differentiate between the ECS task role and the ECS task execution role.
Identify that the application container uses the ECS Task Role for application-level AWS API calls (such as KMS decryption), whereas the Task Execution Role is for container agent operations.
This prevents assigning permissions to the wrong IAM role.
2
Configure the key-level permissions in the KMS key owner's account (Account B).
Update the KMS key policy in Account B to delegate decrypt permissions to the IAM task role ARN from Account A.
AWS KMS requires the key policy to explicitly allow cross-account access, as identity-based IAM policies in the external account are not sufficient on their own.
3
Configure the identity-level permissions in the application's account (Account A).
Attach an IAM policy to the ECS Task Role in Account A allowing the kms:Decrypt action on the target KMS key ARN.
For cross-account access, permissions must be allowed on both the resource policy (key policy) and the identity policy (IAM policy).

Anahtar Kavram

Cross-Account KMS Key Access and ECS Task Roles
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

AWS KMS and Encryption

Bu konudan daha fazla soru