Examkin

Soru

Zorluk: ZorEnhancing Data Protection and Compliance

A gaming company has an existing analytics pipeline where game clients upload telemetry data directly to an Amazon S3 bucket in a shared-services account. The data contains customer identifiers. Currently, the objects are encrypted using SSE-S3. The security team has updated compliance guidelines requiring:
1. Data must be encrypted at rest using a customer-managed key (CMK) that supports automated annual rotation.
2. Cross-account access must be configured to allow a data analytics team in a separate AWS account to query the S3 bucket using Amazon Athena, ensuring they can decrypt the data.
3. Write access to the bucket must be restricted so that only clients coming from a specific list of corporate IP ranges can put objects.

Which of the following actions should the Solutions Architect take to enhance data protection and meet these compliance requirements? (Select TWO.)

  1. Create a customer managed key (CMK) in the shared-services account and configure the S3 bucket to use SSE-KMS. Update the key policy to allow the IAM role used by Amazon Athena in the analytics account to perform the kms:Decrypt action.Cevap
  2. Update the S3 bucket policy in the shared-services account to grant the Amazon Athena IAM role in the analytics account s3:GetObject and s3:ListBucket permissions, and add a condition denying s3:PutObject requests that do not originate from the allowed corporate IP ranges.Cevap
  3. C
    Configure the S3 bucket to use SSE-KMS with the AWS-managed key (aws/s3). Update the key policy of aws/s3 to grant the Amazon Athena IAM role in the analytics account kms:Decrypt permissions.
  4. D
    Attach a Service Control Policy (SCP) at the root of the organization that explicitly grants the Amazon Athena IAM role in the analytics account permission to access the S3 bucket and the KMS key in the shared-services account.
  5. E
    Modify the trust policy of the Amazon Athena IAM role in the analytics account to list the S3 bucket ARN in the shared-services account as a trusted service principal, thereby allowing cross-account read access without modifying the S3 bucket policy.

Cevap

Create a customer managed key (CMK) in the shared-services account with cross-account access to the Athena role, and update the S3 bucket policy to allow cross-account access with IP restrictions on write operations.
To satisfy the requirements, a customer managed key (CMK) must be created in the shared-services account because AWS-managed keys (like aws/s3) cannot have their key policies modified to grant cross-account permissions. The key policy of the CMK must explicitly allow the analytics account's Athena execution IAM role to perform the decrypt action. Furthermore, the S3 bucket policy in the shared-services account must be updated to grant the cross-account Athena IAM role read permissions (GetObject and ListBucket) and enforce IP-based write restrictions using a condition block.

Adım Adım Çözüm

1
Evaluate KMS key type requirements.
Since cross-account access to encrypted S3 objects is required, standard AWS-managed keys (aws/s3) cannot be used because their key policies are immutable. A customer managed key (CMK) must be created.
Customer managed keys allow policy updates to authorize cross-account decryption.
2
Configure S3 bucket policy for cross-account read access and write restrictions.
Create a bucket policy in the shared-services account that allows s3:GetObject and s3:ListBucket for the external Athena IAM role. Include a conditional deny block restricting s3:PutObject actions to specific corporate IP ranges.
S3 cross-account access requires explicit permission in both the IAM policy of the calling principal and the S3 bucket policy.
3
Update the KMS key policy.
Grant kms:Decrypt permissions to the external Athena IAM role ARN in the key policy of the CMK.
The client must have both S3 read permissions and KMS decrypt permissions to read the encrypted S3 objects.

Anahtar Kavram

Cross-account S3 access with SSE-KMS encryption requires configuring both the S3 bucket policy and the customer managed KMS key policy to permit the external IAM principal, as AWS-managed keys cannot be shared cross-account.
Bu soruyu puanla

Konular

Enhancing Data Protection and Compliance