Examkin

Soru

Zorluk: ZorIdentity and Access Management (IAM)

An enterprise architecture uses a centralized logging account (Account A) containing an Amazon S3 bucket for security audit logs. The bucket is encrypted using an AWS KMS customer managed key owned by Account A. A security auditing application runs on Amazon EC2 instances in a production account (Account B) and must write compliance reports directly to the S3 bucket in Account A.

Which combination of configuration steps will allow the application to securely write reports to the bucket while adhering to the principle of least privilege?

  1. Configure the S3 bucket policy in Account A to allow the IAM role of the EC2 instances in Account B to perform the s3:PutObject action. Configure the KMS key policy in Account A to allow the EC2 instances' IAM role to perform the kms:GenerateDataKey action. Attach an identity-based policy to the EC2 instance IAM role in Account B that grants permissions for both actions.Cevap
  2. B
    Create an IAM user in Account A with s3:PutObject and kms:GenerateDataKey permissions. Store the IAM user's Access Key ID and Secret Access Key as plaintext parameters in Systems Manager Parameter Store in Account B, and configure the EC2 instances to retrieve these credentials to authenticate S3 API operations.
  3. C
    Modify the S3 bucket policy in Account A to allow the root user of Account B to perform the s3:PutObject action. Store the Account B root credentials in Systems Manager Parameter Store in Account B, and configure the EC2 instances to use these credentials to authenticate API calls to the S3 bucket.
  4. D
    Configure the EC2 instance role in Account B with s3:PutObject permissions and configure the S3 bucket policy in Account A to trust Account B. Enable automatic key rotation on the KMS key in Account A to automatically authorize and grant access to the EC2 instance role in Account B without needing to modify the KMS key policy.

Cevap

Configure the S3 bucket policy in Account A to allow the IAM role of the EC2 instances in Account B to perform the s3:PutObject action. Configure the KMS key policy in Account A to allow the EC2 instances' IAM role to perform the kms:GenerateDataKey action. Attach an identity-based policy to the EC2 instance IAM role in Account B that grants permissions for both actions.
For cross-account access where the target S3 bucket is encrypted using a Customer Managed Key, two conditions must be met: both the identity-based policy (in the caller's account) and the resource-based policies (S3 bucket policy and KMS key policy in the target account) must allow the actions. The EC2 instance role in Account B must be granted permissions to perform 's3:PutObject' and 'kms:GenerateDataKey'. Correspondingly, Account A's S3 bucket policy and KMS key policy must trust and allow the EC2 role from Account B to perform these actions.

Adım Adım Çözüm

1
Analyze cross-account S3 access requirements.
Identify that the destination S3 bucket is in Account A and the source EC2 instance is in Account B. To allow access, we need both a resource-based policy (S3 bucket policy in Account A) allowing the external entity, and an identity-based policy (IAM role in Account B) allowing the action.
For cross-account access, AWS evaluates permissions in both the truster and trustee accounts; both must explicitly allow the action.
2
Analyze KMS encryption requirements for cross-account S3 uploads.
Determine that since the bucket uses a Customer Managed Key in Account A, the S3 client must generate a data key. This requires kms:GenerateDataKey permissions. Both the KMS key policy in Account A and the IAM role in Account B must allow this action.
When writing to a KMS-encrypted S3 bucket, S3 requires the caller to possess permissions to interact with the KMS key for data key generation.
3
Compare credential management and security best practices.
Confirm that using an EC2 instance profile (IAM role) is the most secure method because it automatically handles rotation of temporary credentials. Reject options that use IAM user long-term credentials or root user credentials, and reject storing sensitive keys in plaintext.
This adheres to the AWS Well-Architected Framework security pillar, specifically the principle of least privilege and avoiding long-term credentials.

Anahtar Kavram

Cross-Account IAM and Resource Policy Evaluation with KMS Encryption
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru