A company is centralizing its Amazon S3 data access logs from multiple member AWS accounts into a single S3 bucket located in a dedicated security account. The security team must encrypt the centralized logs at rest using SSE-KMS to comply with internal data protection standards. The solutions architect needs to configure the encryption so that member accounts can successfully write their encrypted logs to the destination S3 bucket.
Which configuration will meet these requirements?
- Create a customer managed KMS key in the security account, and configure its key policy to grant the member accounts permissions to generate data keys and decrypt.Cevap
- BUse the default AWS-managed KMS key for Amazon S3 (aws/s3) in the security account, and update its key policy to grant cross-account permissions to the member accounts.
- CAttach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the member accounts that grants them explicit access to the default AWS-managed S3 KMS key (aws/s3) in the security account.
- DConfigure the S3 bucket policy in the security account to delegate KMS decryption and data key generation permissions directly to the member accounts without using a KMS key policy.
Cevap
Create a customer managed KMS key in the security account, and configure its key policy to grant the member accounts permissions to generate data keys and decrypt.
To support cross-account SSE-KMS encryption for S3, a customer managed key is required because AWS-managed keys (such as aws/s3) cannot be shared across accounts. The key policy of the customer managed key must explicitly delegate access to the member accounts, allowing them to perform kms:GenerateDataKey and kms:Decrypt operations.
Adım Adım Çözüm
Anahtar Kavram
Cross-account KMS key sharing and policy delegation limitations
Tahmini Süre:1m 0s