Soru

Zorluk: ZorEnhancing Data Protection and Compliance

An enterprise hosts its retail application in a Production AWS account where sensitive customer transaction receipts are stored in an Amazon S3 bucket. The bucket is encrypted using a Customer Managed Key (CMK) in the Production account. To meet strict regulatory requirements, the security team mandates that these logs must be replicated using S3 Same-Region Replication (SRR) to a centralized archive S3 bucket in a separate Compliance AWS account. The archive bucket has S3 Object Lock enabled in compliance mode. The security policy dictates that the replicated objects must be encrypted at rest in the Compliance account using a KMS CMK owned by the Compliance account, and no AWS-managed keys may be used for cross-account operations. Which combination of configurations is required to successfully enable cross-account replication of these encrypted objects while adhering to the principle of least privilege?

  1. Update the destination KMS key policy in the Compliance account to grant the Production replication IAM role permissions for kms:GenerateDataKey and kms:Encrypt. Modify the destination S3 bucket policy to grant the replication role permissions for s3:ReplicateObject and s3:ReplicateTags. In the Production account, attach an IAM policy to the replication role allowing kms:Decrypt and kms:DescribeKey on the source KMS key, and kms:Encrypt and kms:GenerateDataKey on the destination KMS key.Cevap
  2. B
    Configure the destination S3 bucket to use the default AWS-managed key (aws/s3) for encryption in the Compliance account. Update the destination S3 bucket policy to allow the Production replication IAM role to replicate objects. In the Production account, attach an IAM policy to the replication role allowing kms:Decrypt on the source KMS key and kms:Encrypt on the destination aws/s3 key.
  3. C
    Attach a Service Control Policy (SCP) at the Organizational Unit level that grants the Production replication IAM role direct access to use the Compliance KMS CMK and replicate objects into the Compliance S3 bucket. In the Production account, grant the replication IAM role permissions to decrypt using the source KMS key and encrypt using the destination KMS key.
  4. D
    Modify the destination S3 bucket policy in the Compliance account to allow the Production replication IAM role to perform both s3:ReplicateObject and kms:Encrypt actions on the destination resources. In the Production account, attach an IAM policy to the replication role that allows decryption using the source KMS key and encryption using the destination KMS key.

Cevap

Update the destination KMS key policy in the Compliance account to trust the replication IAM role, configure the destination S3 bucket policy to allow the replication role to write objects, and grant the replication IAM role the necessary KMS and S3 permissions in its IAM policy.
The correct configuration satisfies the requirement for cross-account S3 replication with KMS encryption. The source replication role must have decrypt permissions on the source KMS key, and encrypt permissions on the destination KMS key. Since this is a cross-account operation, trust must be established on the destination resources: the destination S3 bucket policy must allow the replication role to replicate objects, and the destination KMS key policy must explicitly allow the replication role to use the key.

Adım Adım Çözüm

1
Configure permissions for the source KMS key.
The replication role is granted permission to decrypt objects in the source account.
Since the source S3 bucket is encrypted using a Customer Managed Key, the S3 replication service role must be able to decrypt the source objects before replicating them.
2
Configure the destination S3 bucket policy in the Compliance account.
The destination bucket policy allows the source replication role to replicate objects and tags.
For cross-account S3 operations, the destination resource policy (bucket policy) must explicitly authorize the external account's principal.
3
Configure the destination KMS key policy in the Compliance account.
The destination KMS CMK key policy allows the source replication role to execute kms:Encrypt and kms:GenerateDataKey.
Cross-account access to KMS keys is not governed by IAM policies alone; the key policy itself must trust the external principal to prevent access failures.

Anahtar Kavram

Cross-Account S3 Replication with KMS Encryption
Bu soruyu puanla