Examkin

Soru

Zorluk: OrtaSecurity and Compliance Control Design

A fintech startup, PayFlow, is designing a new compliance reporting solution. An application running in a Production Account (Account A) stores transaction logs in an Amazon S3 bucket. The compliance audit team needs to run SQL queries on these logs using Amazon Athena from an Audit Account (Account B) via an IAM role named 'ComplianceAuditorRole'. The S3 bucket is encrypted using an AWS KMS Customer Managed Key (CMK) in Account A. The compliance team mandates that access must be restricted to the minimum necessary permissions and must enforce cross-account separation of duties. Which combination of actions is required to enable the 'ComplianceAuditorRole' in Account B to query the S3 bucket in Account A? (Select TWO.)

  1. Configure the KMS key policy of the Customer Managed Key (CMK) in Account A to allow the ComplianceAuditorRole in Account B to perform the kms:Decrypt and kms:DescribeKey actions.Cevap
  2. Configure the S3 bucket policy in Account A to allow the ComplianceAuditorRole in Account B to perform the s3:GetObject and s3:ListBucket actions.Cevap
  3. C
    Configure the S3 bucket in Account A to use the default AWS-managed key (aws/s3) for encryption, and attach an IAM policy to the ComplianceAuditorRole in Account B that permits decryption of the aws/s3 key.
  4. D
    Attach a Service Control Policy (SCP) to the Organizational Unit containing Account B that explicitly allows the s3:GetObject action on the S3 bucket in Account A.
  5. E
    Configure the S3 bucket policy in Account A to grant access to the root user of Account B, specifying the AWS Organization ID as the Principal element.

Cevap

To configure cross-account S3 bucket access encrypted with a Customer Managed Key (CMK), you must allow the external IAM role access in both the S3 bucket policy and the KMS CMK key policy in the source account, while also granting the permissions in the target account's IAM role.
To establish cross-account access to encrypted S3 resources, the source account (Account A) must delegate trust. This is accomplished by adding the external IAM role in Account B as an authorized principal in the S3 bucket policy for the S3 actions (s3:GetObject and s3:ListBucket) and in the KMS CMK key policy for the decryption actions (kms:Decrypt and kms:DescribeKey). The target account's IAM role must also have a policy allowing these actions.

Adım Adım Çözüm

1
Grant cross-account access to the KMS CMK
The key policy of the CMK in Account A is updated to include the IAM role from Account B as a principal with permissions for kms:Decrypt and kms:DescribeKey.
AWS KMS Customer Managed Keys require explicit key policy delegation to allow decryption by cross-account principals, as AWS-managed keys cannot be shared.
2
Grant cross-account access to the S3 bucket
The S3 bucket policy in Account A is updated to grant s3:GetObject and s3:ListBucket permissions to the IAM role in Account B.
For cross-account S3 access, the resource-based policy must explicitly allow access to the external principal, in addition to the external principal's own IAM policy.

Anahtar Kavram

Cross-account access to encrypted S3 resources requires both resource policy delegation (S3 bucket policy and KMS key policy) in the source account and identity policy permissions in the destination account.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru