Examkin

Soru

Zorluk: Çok zorMulti-Account Governance and Organizational Structure

A global financial technology enterprise uses AWS Organizations to manage over 100 accounts. The security engineering team is implementing a strict data classification and encryption compliance strategy. The primary requirement is that all sensitive transactional data stored in Amazon S3 buckets within the "Workloads" Organizational Unit (OU) must be encrypted using AWS KMS Customer Managed Keys (CMKs) created and managed centrally inside a dedicated "Security" account. Additionally, any direct uploads to these buckets must be blocked if they do not explicitly request encryption using the central CMKs, while preventing member account administrators from altering these baseline encryption constraints. Which of the following actions should the Solutions Architect recommend to achieve this governance policy? (Select TWO.)

  1. In the Workloads OU, attach a Service Control Policy (SCP) that denies the s3:PutObject action if the request condition s3:x-amz-server-side-encryption-aws-kms-key-id does not match the ARN of the central Customer Managed Key (CMK), or if the s3:x-amz-server-side-encryption header is not set to aws:kms.Cevap
  2. In the centralized Security account, configure the key policy of the Customer Managed Key (CMK) to grant kms:GenerateDataKey and kms:Decrypt permissions to the organization's member accounts, utilizing the aws:PrincipalOrgID condition to restrict access.Cevap
  3. C
    In the Workloads OU, attach a Service Control Policy (SCP) that grants the s3:PutObject and kms:GenerateDataKey permissions for resources in the member accounts when the encryption key matches the central CMK, eliminating the need for local IAM policies.
  4. D
    Enable default S3 bucket encryption in the Workloads accounts using the AWS-managed KMS key (aws/s3) and attach a Service Control Policy (SCP) to the Workloads OU that permits cross-account decryption requests to this key.
  5. E
    Use AWS Resource Access Manager (RAM) to share the central S3 buckets and KMS keys from the Security account to the member accounts in the Workloads OU, without enabling sharing with external entities in the RAM settings.

Cevap

In the Workloads OU, attach a Service Control Policy (SCP) that denies s3:PutObject if it does not specify the centralized Customer Managed Key (CMK) or aws:kms encryption, and in the Security account, configure the key policy of the CMK to allow kms:GenerateDataKey and kms:Decrypt permissions to the organization's member accounts using the aws:PrincipalOrgID condition.
To centrally govern S3 encryption, an SCP must conditionally deny object uploads unless they request SSE-KMS encryption with the specific Customer Managed Key (CMK) ARN from the central Security account. Simultaneously, the central CMK key policy must be modified to permit member account principals (scoped securely via the organization ID condition) to use the key for encrypting and decrypting data.

Adım Adım Çözüm

1
Analyze the encryption and control requirements.
Identify that data must be encrypted with a centralized CMK in the Security account, and unauthorized uploads must be blocked at the organization level.
This establishes that we need cross-account key sharing and organizational guardrails.
2
Determine the mechanism to enforce the key usage on upload.
Identify that an SCP attached to the Workloads OU can inspect request headers during s3:PutObject and deny the action if the target key ARN or the encryption type does not match the central CMK.
SCPs act as organizational guardrails that can conditionally deny non-compliant actions across all member accounts.
3
Address key permissions for cross-account access.
Understand that the centralized Customer Managed Key (CMK) policy must be modified to allow member accounts to use it, and use aws:PrincipalOrgID to dynamically target all accounts in the organization.
By default, KMS keys are only usable within their host account, and AWS-managed keys cannot support cross-account sharing.
4
Evaluate the viability of AWS Resource Access Manager (RAM).
Discard RAM because it does not support sharing S3 buckets or KMS keys.
Understanding the limits of RAM avoids invalid architecture configurations.

Anahtar Kavram

Cross-account KMS key sharing and SCP conditional enforcement for S3 encryption
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Multi-Account Governance and Organizational Structure

Bu konudan daha fazla soru