A company has configured an AWS Organizations environment with a production account and a security auditing account. A solutions architect is setting up secure, cross-account access for a containerized application running on Amazon Elastic Container Service (Amazon ECS) in the production account. The application must read compliance report files stored in a private Amazon S3 bucket within the security auditing account. The architect needs to implement a solution that adheres to the principle of least privilege and avoids the use of long-term credentials. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)
- Attach an IAM policy to the ECS task role in the production account that allows the s3:GetObject action on the S3 bucket in the security auditing account.Cevap
- Modify the bucket policy of the S3 bucket in the security auditing account to allow the s3:GetObject action for the Amazon Resource Name (ARN) of the ECS task role in the production account.Cevap
- CCreate an IAM user in the security auditing account, generate access keys, and embed them directly in the ECS task definition as environment variables.
- DConfigure the S3 bucket policy in the security auditing account to allow read access to the production account's root user, and configure the ECS task to authenticate using the production account's root credentials.
- ECreate an IAM user in the security auditing account, store the user's access keys as a plaintext String parameter in Systems Manager Parameter Store, and configure the ECS task to retrieve them.
Cevap
To securely implement cross-account access, the solutions architect should attach an IAM policy to the ECS task role in the production account allowing s3:GetObject, and modify the destination S3 bucket's resource policy in the auditing account to allow the s3:GetObject action for the production account's ECS task role ARN.
For cross-account access to Amazon S3, both the IAM identity policy (attached to the ECS task role in the source account) and the S3 bucket policy (resource policy in the destination account) must explicitly allow the operation. This avoids the use of long-term credentials by leveraging temporary credentials generated when the ECS task assumes its execution role.
Adım Adım Çözüm
Anahtar Kavram
Cross-account access to S3 resources requires explicit permissions on both the identity-based policy in the source account and the resource-based bucket policy in the destination account, utilizing temporary security credentials.