An enterprise hosts its retail application in a Production AWS account where sensitive customer transaction receipts are stored in an Amazon S3 bucket. The bucket is encrypted using a Customer Managed Key (CMK) in the Production account. To meet strict regulatory requirements, the security team mandates that these logs must be replicated using S3 Same-Region Replication (SRR) to a centralized archive S3 bucket in a separate Compliance AWS account. The archive bucket has S3 Object Lock enabled in compliance mode. The security policy dictates that the replicated objects must be encrypted at rest in the Compliance account using a KMS CMK owned by the Compliance account, and no AWS-managed keys may be used for cross-account operations. Which combination of configurations is required to successfully enable cross-account replication of these encrypted objects while adhering to the principle of least privilege?
- Update the destination KMS key policy in the Compliance account to grant the Production replication IAM role permissions for kms:GenerateDataKey and kms:Encrypt. Modify the destination S3 bucket policy to grant the replication role permissions for s3:ReplicateObject and s3:ReplicateTags. In the Production account, attach an IAM policy to the replication role allowing kms:Decrypt and kms:DescribeKey on the source KMS key, and kms:Encrypt and kms:GenerateDataKey on the destination KMS key.Cevap
- BConfigure the destination S3 bucket to use the default AWS-managed key (aws/s3) for encryption in the Compliance account. Update the destination S3 bucket policy to allow the Production replication IAM role to replicate objects. In the Production account, attach an IAM policy to the replication role allowing kms:Decrypt on the source KMS key and kms:Encrypt on the destination aws/s3 key.
- CAttach a Service Control Policy (SCP) at the Organizational Unit level that grants the Production replication IAM role direct access to use the Compliance KMS CMK and replicate objects into the Compliance S3 bucket. In the Production account, grant the replication IAM role permissions to decrypt using the source KMS key and encrypt using the destination KMS key.
- DModify the destination S3 bucket policy in the Compliance account to allow the Production replication IAM role to perform both s3:ReplicateObject and kms:Encrypt actions on the destination resources. In the Production account, attach an IAM policy to the replication role that allows decryption using the source KMS key and encryption using the destination KMS key.