Examkin

Soru

Zorluk: OrtaSecurity and Compliance Control Design

An enterprise is deploying a centralized audit solution where an IAM role in the Security Account (Account A) must analyze compliance reports stored in an Amazon S3 bucket within the Production Account (Account B). The S3 bucket is configured with default encryption, and the organization's compliance policy mandates that all data access must be audited and restricted to the minimum required cross-account permissions. Which combination of configuration steps will successfully and securely enable the S3 bucket and KMS key access for Account A?

  1. Configure the S3 bucket in Account B to be encrypted using a Customer Managed Key (CMK). Update the key policy of the CMK in Account B to grant kms:Decrypt permissions to the IAM role in Account A. Update the S3 bucket policy in Account B to grant s3:GetObject and s3:ListBucket permissions to the IAM role in Account A. Attach an IAM policy to the IAM role in Account A that allows s3:GetObject and s3:ListBucket on the S3 bucket, and kms:Decrypt on the CMK in Account B.Cevap
  2. B
    Configure the S3 bucket in Account B to use the default AWS managed key (aws/s3) for encryption. Update the key policy of the AWS managed key in Account B to grant kms:Decrypt permissions to the IAM role in Account A. Configure the S3 bucket policy in Account B to grant s3:GetObject and s3:ListBucket permissions to the IAM role in Account A. Attach an IAM policy to the IAM role in Account A that allows s3:GetObject, s3:ListBucket, and kms:Decrypt operations.
  3. C
    Configure the S3 bucket in Account B to be encrypted using a Customer Managed Key (CMK). Attach a Service Control Policy (SCP) to the Organizational Unit containing Account A and Account B that explicitly allows the IAM role in Account A to perform s3:GetObject and kms:Decrypt on resources in Account B, without configuring local IAM policies in Account A.
  4. D
    Configure the S3 bucket in Account B to be encrypted using a Customer Managed Key (CMK). Update the key policy of the CMK in Account B to grant kms:Decrypt permissions to the IAM role in Account A. In Account B, configure the S3 bucket policy to grant read access but omit the explicit principal declaration for the IAM role in Account A, instead using a wildcard principal with no organizational condition.

Cevap

Configure the S3 bucket in the Production Account to use a Customer Managed Key (CMK), update its key policy to grant decryption permissions to the Security Account's IAM role, configure the S3 bucket policy to grant read access to the role, and configure the IAM policy in the Security Account to allow these S3 and KMS operations.
The correct solution uses a Customer Managed Key (CMK) which supports policy modification, allows cross-account access via the key policy, specifies the external principal in the S3 bucket policy, and configures the identity policy of the calling role to trust the external resources.

Adım Adım Çözüm

1
Ensure the S3 bucket is encrypted using a Customer Managed Key (CMK) rather than an AWS managed key.
Allows customization of the KMS key policy to grant cross-account access, which is impossible with AWS managed keys.
AWS-managed keys do not allow policy modifications to authorize cross-account principals.
2
Modify the KMS CMK key policy in the Production Account to grant decryption permissions to the Security Account's IAM role.
Authorizes the external IAM role to decrypt the data encrypted by the key.
Cross-account KMS access must be explicitly enabled at the key level.
3
Configure the S3 bucket policy in the Production Account to grant read access to the Security Account's IAM role.
Authorizes the external role to perform read operations on the bucket resources.
S3 bucket access across accounts requires permission in the bucket policy.
4
Attach an IAM policy to the IAM role in the Security Account that allows access to the S3 bucket and the KMS CMK.
Grants the role permission to initiate S3 read and KMS decrypt calls to the resources in the Production Account.
For cross-account access, permissions must be granted on both the trust side (resource policy) and the calling side (identity policy).

Anahtar Kavram

Cross-account resource access with KMS encryption
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru