Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM)

A company has hired an external auditing firm to review sensitive database logs stored in an Amazon S3 bucket. The logs are encrypted with a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The audit team uses their own AWS account to manage their IAM users. A solutions architect must design a secure architecture to grant the external auditors temporary, read-only access to the logs. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create an IAM role in the company's AWS account with a trust policy that trusts the external auditors' AWS account, and attach a read-only S3 permissions policy to the role.Cevap
  2. Configure the KMS key policy of the Customer Managed Key (CMK) to grant the external auditors' assumed IAM role decryption permissions.Cevap
  3. C
    Create individual IAM users in the company's AWS account for each auditor, and grant them read-only permissions using long-term credentials.
  4. D
    Enable automatic key rotation for the KMS Customer Managed Key (CMK) to automatically re-encrypt the historical logs under a new key version.
  5. E
    Share the AWS account root user credentials with the auditing team to allow direct access to the KMS keys and S3 buckets.

Cevap

Creating an IAM role in the company's AWS account with a trust policy that trusts the external auditors' account while attaching a read-only S3 policy, and updating the KMS key policy of the Customer Managed Key to grant decryption permissions to the auditors' assumed role.
The correct solution requires configuring cross-account access via an IAM role and granting access to the KMS Customer Managed Key used for encrypting the S3 objects. First, creating an IAM role in the trusting account (the company's account) with a trust policy that specifies the trusted account (the auditors' account) allows the auditors to assume the role. Attaching a read-only S3 policy restricts their access to the required resources. Second, since the objects are encrypted using a Customer Managed Key, KMS requires that the key policy itself explicitly trust the assumed IAM role for decryption operations.

Adım Adım Çözüm

1
Configure trust relationship for cross-account access.
An IAM role is created in the company's account that trusts the auditors' AWS account ID, allowing their IAM users to assume the role.
This establishes a secure trust boundary without creating long-term credentials for external entities.
2
Assign read-only permissions to the S3 bucket.
An IAM policy is attached to the role granting read-only access to the specific S3 bucket.
This adheres to the principle of least privilege by ensuring the role can only read the logs.
3
Update the KMS Customer Managed Key policy.
The KMS key policy is modified to grant the assumed role permissions to perform the decrypt operation.
Because the objects are encrypted using a Customer Managed Key, the role needs explicit decryption permissions in the key policy as S3 permissions alone are insufficient.

Anahtar Kavram

AWS KMS key policies and cross-account IAM roles for delegation of access to encrypted S3 resources.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru