Soru

Zorluk: KolayEnhancing Data Protection and Compliance

A company is centralizing its Amazon S3 data access logs from multiple member AWS accounts into a single S3 bucket located in a dedicated security account. The security team must encrypt the centralized logs at rest using SSE-KMS to comply with internal data protection standards. The solutions architect needs to configure the encryption so that member accounts can successfully write their encrypted logs to the destination S3 bucket.

Which configuration will meet these requirements?

  1. Create a customer managed KMS key in the security account, and configure its key policy to grant the member accounts permissions to generate data keys and decrypt.Cevap
  2. B
    Use the default AWS-managed KMS key for Amazon S3 (aws/s3) in the security account, and update its key policy to grant cross-account permissions to the member accounts.
  3. C
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the member accounts that grants them explicit access to the default AWS-managed S3 KMS key (aws/s3) in the security account.
  4. D
    Configure the S3 bucket policy in the security account to delegate KMS decryption and data key generation permissions directly to the member accounts without using a KMS key policy.

Cevap

Create a customer managed KMS key in the security account, and configure its key policy to grant the member accounts permissions to generate data keys and decrypt.
To support cross-account SSE-KMS encryption for S3, a customer managed key is required because AWS-managed keys (such as aws/s3) cannot be shared across accounts. The key policy of the customer managed key must explicitly delegate access to the member accounts, allowing them to perform kms:GenerateDataKey and kms:Decrypt operations.

Adım Adım Çözüm

1
Determine the type of KMS key needed for cross-account S3 write access.
A customer managed KMS key is selected because AWS-managed keys (such as aws/s3) cannot be shared across different AWS accounts or have their policies modified.
AWS security boundaries restrict AWS-managed KMS keys to local account usage only.
2
Configure the KMS key policy in the central security account.
The key policy is updated to allow member account IAM principals to call kms:GenerateDataKey and kms:Decrypt.
S3 requires both permissions to encrypt new objects upon upload and decrypt them during access or validation.

Anahtar Kavram

Cross-account KMS key sharing and policy delegation limitations
Tahmini Süre:1m 0s
Bu soruyu puanla