Examkin

Soru

Zorluk: KolaySecurity and Compliance Control Design

A retail company wants to share daily transaction logs stored in an Amazon S3 bucket in Account A (111111111111111111111111) with an analytics application running on Amazon EC2 instances in Account B (222222222222222222222222). The S3 bucket is configured with default encryption using AWS Key Management Service (AWS KMS). Which of the following describes a mandatory configuration for the KMS key to allow the analytics application in Account B to decrypt the log files?

  1. A customer managed KMS key must be used, and its key policy in Account A must explicitly grant the analytics application's role in Account B permission to use the key.Cevap
  2. B
    The default AWS managed KMS key (aws/s3) can be used, provided that a Service Control Policy (SCP) is applied at the organization level to permit cross-account decryption.
  3. C
    The default AWS managed KMS key (aws/s3) can be used, as long as Account B attaches an IAM policy to the EC2 instance role that grants the kms:Decrypt permission.
  4. D
    A customer managed KMS key must be used, and it must be shared with Account B using AWS Resource Access Manager (RAM) to delegate access.

Cevap

A customer managed KMS key must be used, and its key policy in Account A must explicitly grant the analytics application's role in Account B permission to use the key.
To decrypt resources across different AWS accounts, the KMS key must support policy modification. AWS managed KMS keys (such as aws/s3) have fixed policies that cannot be altered to grant cross-account access. Therefore, a customer managed KMS key must be utilized. Its key policy must be updated to explicitly grant the decryption permissions to Account B's IAM role.

Adım Adım Çözüm

1
Determine the type of AWS KMS key being used.
Identify that default S3 encryption often uses AWS managed keys (aws/s3), but these cannot be shared cross-account.
AWS managed KMS keys do not support editing key policies, which is required to delegate permissions to a different account.
2
Configure a customer managed KMS key.
Create a customer managed key in Account A and configure S3 to use it.
Customer managed keys allow their key policies to be edited to grant cross-account permissions.
3
Modify the customer managed KMS key policy.
Add a statement to the key policy in Account A that lists the ARN of the analytics IAM role in Account B as a principal and grants kms:Decrypt permissions.
Cross-account access to KMS keys requires explicit trust configuration in the key policy itself, as IAM policies in Account B alone cannot grant access to Account A's resources.

Anahtar Kavram

Cross-account access to KMS-encrypted resources requires customer managed keys and explicit key policy delegation.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru