Examkin

Soru

Zorluk: Çok zorIdentity and Access Management (IAM)

An enterprise application running on Amazon ECS tasks in AWS Account A (111111111111111111111111) must retrieve sensitive daily reports from an Amazon S3 bucket located in AWS Account B (222222222222222222222222). The S3 bucket is encrypted using an AWS KMS customer managed key (CMK) in Account B. The solution must ensure that only the ECS tasks can access the data, adhere strictly to the principle of least privilege, and avoid the use of long-term credentials. Which combination of configurations will securely meet these requirements?

  1. A
    Create an IAM user in Account B with S3 and KMS permissions, generate access keys, and embed these credentials directly into the container image of the ECS tasks to facilitate cross-account authentication.
  2. Configure the ECS task role in Account A with permissions to perform `s3:GetObject` on the S3 bucket and `kms:Decrypt` on the KMS key. In Account B, update the S3 bucket policy and the KMS key policy to explicitly grant `s3:GetObject` and `kms:Decrypt` permissions to the specific ECS task role ARN from Account A.Cevap
  3. C
    Create an IAM user in Account B with S3 and KMS permissions. Generate access keys for this user, store them as a plaintext String parameter in AWS Systems Manager Parameter Store in Account A, and configure the ECS tasks to retrieve them at runtime.
  4. D
    Configure the S3 bucket policy in Account B to allow the ECS task role from Account A access. Rely on enabling automatic key rotation on the KMS CMK in Account B to automatically re-encrypt the S3 objects and grant cross-account decryption rights without modifying the key policy.

Cevap

Configure the ECS task role in Account A with S3 and KMS permissions, and explicitly grant access to this task role in both the S3 bucket policy and the KMS key policy of Account B.
The correct solution uses an IAM Task Role to supply temporary credentials to the ECS tasks. S3 cross-account access requires the bucket policy in Account B to trust the Task Role ARN from Account A, and the Task Role's identity policy to allow `s3:GetObject`. Crucially, because the bucket is encrypted with a customer managed key, the KMS key policy in Account B must also explicitly trust the Task Role ARN from Account A, as S3 bucket policies cannot delegate KMS permissions.

Adım Adım Çözüm

1
Configure the ECS Task Role in Account A.
The tasks assume a temporary security credential with identity-based permissions to call `s3:GetObject` and `kms:Decrypt`.
The application must be authorized to perform these actions by its own account before cross-account policies can evaluate the request.
2
Update the S3 bucket policy in Account B to trust the ECS Task Role ARN.
Cross-account read access to the S3 objects is authorized at the storage layer.
By default, cross-account access to S3 resources requires the resource owner to explicitly trust the external IAM entity.
3
Update the KMS key policy in Account B to trust the ECS Task Role ARN.
Cross-account decryption access is authorized at the cryptographic layer.
S3 bucket policies cannot delegate permissions for KMS CMKs; the key policy itself must explicitly trust the external IAM principal for decryption.

Anahtar Kavram

Cross-account IAM authorization for KMS-encrypted S3 resources
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru