Examkin

Soru

Zorluk: ZorStrengthening Identity, Access, and Network Security

An enterprise runs a data processing application on Amazon EC2 instances in an application VPC within Account A. The application needs to retrieve daily encrypted logs from an Amazon S3 bucket located in Account B. The data transfer must be highly secure, must not traverse the public internet, and must enforce the principle of least privilege. The S3 bucket is currently encrypted using an AWS KMS key.

Which two actions should a Solutions Architect take to strengthen the identity, access, and network security for this data transfer?

  1. Create a gateway VPC endpoint for Amazon S3 in the application's VPC, and update the route tables to route S3 traffic through this endpoint. Update the S3 bucket policy in the security account to allow the application's IAM role to access the bucket, with a condition restricting requests to those originating from the S3 gateway VPC endpoint ID.Cevap
  2. Configure the S3 bucket to use a customer managed KMS key. Update the KMS key policy in the security account to trust the application's account and grant the application's IAM role permission to perform decrypt and generate data key operations, and update the application's IAM policy to allow these same actions on the KMS key.Cevap
  3. C
    Configure the S3 bucket to use the default AWS managed KMS key (aws/s3). Update the application's IAM policy in the application account to allow the application's IAM role to perform decrypt and generate data key operations on the aws/s3 KMS key in the security account.
  4. D
    Create an internet gateway in the application's VPC and configure a public subnet. Deploy a NAT gateway in the public subnet, and route all S3 traffic through it. Update the S3 bucket policy in the security account to restrict access only to the Elastic IP address of the NAT gateway using the aws:SourceIp condition.
  5. E
    Use AWS Resource Access Manager (RAM) to share the S3 Gateway VPC Endpoint from the application account to the security account. Create a Service Control Policy (SCP) at the organizational unit (OU) level that permits the application's IAM role to access the S3 bucket directly, bypassing the need for local IAM policy updates.

Cevap

Creating an S3 gateway VPC endpoint in the application's VPC, updating the route tables, and restricting the bucket policy to the gateway VPC endpoint ID, while also using a customer managed KMS key with cross-account access granted via key and IAM policies.
To satisfy the security requirements of keeping traffic off the public internet and using least-privilege access: first, a gateway VPC endpoint is configured in the application's VPC to route S3 traffic internally. The S3 bucket policy is restricted using the aws:sourceVpce condition, ensuring that only requests coming through the VPC endpoint are allowed. Second, a Customer Managed KMS Key (CMK) is implemented because cross-account access to encrypted S3 resources requires a key policy that explicitly trusts the external account, which is not possible with AWS-managed keys.

Adım Adım Çözüm

1
Set up a gateway VPC endpoint for S3 in the application VPC (Account A) and update the route tables to route all S3 traffic through the endpoint.
Network traffic to S3 is kept entirely within the AWS network, satisfying the constraint of not traversing the public internet.
This establishes a private network path to S3 and avoids public internet exposure.
2
Configure the S3 bucket policy in Account B to permit access to the IAM role in Account A only when the aws:sourceVpce condition matches the gateway VPC endpoint ID created in Account A.
Access is restricted to requests coming strictly from the authorized VPC endpoint.
This enforces least-privilege network constraints at the S3 resource layer.
3
Configure the S3 bucket in Account B to use a Customer Managed Key (CMK) instead of the AWS managed key (aws/s3).
The key policy can now be customized to support cross-account operations.
AWS managed KMS keys do not support policy modification to allow cross-account access.
4
Update the Customer Managed KMS key policy in Account B to grant permission to the external Account A principal, and update the application's IAM policy in Account A to permit the role to perform kms:Decrypt and kms:GenerateDataKey.
The application's IAM role is authorized to decrypt the objects retrieved from S3.
Both key policy (in Account B) and IAM policy (in Account A) must grant the permissions for cross-account KMS usage to succeed.

Anahtar Kavram

Securing cross-account resource access in a multi-account environment using gateway VPC endpoints, custom S3 bucket policies with endpoint conditions, and Customer Managed Keys for cross-account KMS decryption.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security