Examkin

Soru

Zorluk: OrtaSecurity and Compliance Control Design

An e-commerce company, VeloCart Solutions, is designing a secure logging architecture. The application tier runs on Amazon EC2 instances in a Production account. These instances assume an IAM role to write transactional logs containing sensitive customer data. The company requires these logs to be stored in an Amazon S3 bucket in a central Logging account. The logs must be encrypted at rest using a Customer Managed Key (CMK) managed within the Logging account. Which TWO actions must the solutions architect take to ensure the application tier can successfully write the encrypted logs to the central S3 bucket? (Select TWO.)

  1. In the Logging account, configure the S3 bucket policy to grant the Production account's IAM role permission to perform the s3:PutObject action.Cevap
  2. In the Logging account, modify the key policy of the Customer Managed Key to grant the Production account's IAM role permission to perform the kms:GenerateDataKey and kms:Decrypt actions.Cevap
  3. C
    Enable default S3 encryption on the Logging account's bucket using the AWS-managed key aws/s3, and modify the S3 bucket policy to grant the Production account's IAM role permission to write objects.
  4. D
    Attach a Service Control Policy (SCP) to the Organizational Unit of the Logging account that grants the Production account's IAM role permission to perform the s3:PutObject and kms:GenerateDataKey actions.
  5. E
    Configure the IAM policy attached to the Production account's IAM role to grant permission for s3:PutObject on the target bucket, and rely on IAM policy delegation without applying a bucket policy in the Logging account.

Cevap

The solutions architect must configure the S3 bucket policy in the Logging account to grant the Production account's IAM role permission to perform the s3:PutObject action, and modify the KMS key policy in the Logging account to allow the Production account's IAM role to perform the kms:GenerateDataKey and kms:Decrypt actions.
Establishing cross-account write capabilities to an encrypted S3 bucket requires resource policies in the destination account to explicitly authorize the source account's IAM principal. The S3 bucket policy must allow the s3:PutObject action, and the KMS key policy of the Customer Managed Key must allow the kms:GenerateDataKey and kms:Decrypt actions so the application can encrypt objects.

Adım Adım Çözüm

1
Configure the S3 bucket policy in the Logging account.
The Production account's IAM role is granted explicit cross-account write permissions (s3:PutObject) on the central logging bucket.
By default, cross-account access is denied. The target bucket's resource policy must explicitly trust the external IAM identity.
2
Configure the KMS Customer Managed Key policy in the Logging account.
The Production account's IAM role is granted the permissions to generate a data key and decrypt using the KMS key.
When writing to an S3 bucket encrypted with a Customer Managed Key, the writing principal must have permissions to interact with the KMS key to encrypt the payload.

Anahtar Kavram

Cross-account security control design for S3 and KMS encryption
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru