Examkin

Soru

Zorluk: KolayEnhancing Data Protection and Compliance

A retail company hosts a customer loyalty application that stores transaction records in an Amazon S3 bucket. To comply with new data protection regulations, the company must encrypt all objects in the bucket using a key that supports automatic annual rotation. Additionally, the company must securely share these encrypted transaction records with a third-party auditing firm's external AWS account. Which two configuration steps should a solutions architect perform to meet these requirements? (Select TWO.)

  1. Configure the Amazon S3 bucket to use server-side encryption with an AWS KMS customer managed key (SSE-KMS).Cevap
  2. Enable automatic key rotation for the customer managed KMS key, and update its key policy to grant decrypt permissions to the third-party auditing firm's AWS account.Cevap
  3. C
    Configure the S3 bucket to use server-side encryption with the default AWS managed key (aws/s3), as it supports automatic annual rotation and cross-account access by default.
  4. D
    Attach a Service Control Policy (SCP) to the member account that grants kms:Decrypt and kms:DescribeKey permissions to the third-party auditing firm's external AWS account.
  5. E
    Apply an S3 bucket policy that allows the third-party auditing firm's external AWS account to decrypt the objects, while keeping the bucket encrypted with the default AWS managed key (aws/s3).

Cevap

Configure the Amazon S3 bucket to use server-side encryption with an AWS KMS customer managed key (SSE-KMS), and enable automatic key rotation for the customer managed KMS key while updating its key policy to grant decrypt permissions to the third-party auditing firm's AWS account.
To satisfy both the key rotation and external sharing requirements, the solutions architect must use an AWS KMS customer managed key for SSE-KMS. Customer managed keys permit the modification of key policies to delegate decrypt permissions to external AWS accounts, and support automatic annual rotation. Enabling key rotation and defining the decryption policy for the auditing firm's AWS account ensures secure, compliant data protection.

Adım Adım Çözüm

1
Identify the encryption key type that allows cross-account key sharing.
Determine that an AWS KMS customer managed key is required because AWS managed keys (aws/s3) do not allow policy modification to grant cross-account permissions.
Compliance and sharing requirements necessitate key policy customization.
2
Configure the encryption and key rotation behavior.
Enable SSE-KMS on the Amazon S3 bucket with the customer managed key, and turn on the automatic key rotation property in the KMS key configuration.
This automates the annual rotation requirement without manual intervention.
3
Update the KMS key policy to permit external account access.
Add a statement in the KMS key policy that grants the third-party auditing firm's AWS account principal permission to execute the kms:Decrypt action.
An IAM policy or S3 bucket policy alone cannot grant cross-account access to KMS keys without the KMS key policy explicitly delegating it.

Anahtar Kavram

AWS KMS Customer Managed Keys are required for cross-account S3 bucket access because AWS managed keys do not support policy modification.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Enhancing Data Protection and Compliance