Examkin

Soru

Zorluk: OrtaStrengthening Identity, Access, and Network Security

A company is reviewing the security configuration of an application running on Amazon EC2 instances in a production VPC in Account A. The application reads daily transaction files from an Amazon S3 bucket in a shared services VPC in Account B. Both accounts belong to the same AWS Organization. Currently, the S3 bucket is encrypted using the default AWS-managed KMS key (`aws/s3`). The application accesses the S3 bucket over the public internet using an IAM role in Account A. The security team requires that all network traffic between the application and the S3 bucket must remain within the AWS private network, S3 bucket access must be restricted to only traffic originating from the production VPC, and cross-account decryption capability must follow the principle of least privilege. Which combination of configuration changes will meet these security requirements?

  1. A
    Create a Gateway VPC endpoint for S3 in Account A and associate it with the subnet route tables. In Account B, keep the S3 bucket encrypted with the AWS-managed KMS key (`aws/s3`) and grant decryption permissions to Account A's IAM role by modifying the default key policy. Configure the S3 bucket policy in Account B to allow read access to Account A's IAM role only when the request originates from Account A's VPC endpoint ID.
  2. Create a Gateway VPC endpoint for S3 in Account A and associate it with the subnet route tables. In Account B, configure a customer managed KMS key and grant decryption permissions to Account A's IAM role in the key policy. Configure the S3 bucket policy in Account B to allow read access to Account A's IAM role only when the request originates from Account A's VPC endpoint ID.Cevap
  3. C
    Create a Gateway VPC endpoint for S3 in Account A and associate it with the subnet route tables. In Account B, configure a customer managed KMS key. Attach a Service Control Policy (SCP) to the Organizational Unit that grants the decryption permission on the KMS key directly to Account A's IAM role, and configure the S3 bucket policy in Account B to allow read access from Account A.
  4. D
    Create a Gateway VPC endpoint for S3 in Account A and associate it with the subnet route tables. In Account B, configure a customer managed KMS key. Create a Route 53 Private Hosted Zone for S3 in Account B and associate it with Account A's VPC, relying on this association to authorize and route cross-account decryption requests to the key without modifying its policy.

Cevap

Create a Gateway VPC endpoint for S3 in Account A, use a customer managed KMS key in Account B with a key policy allowing access to Account A's IAM role, and restrict the S3 bucket policy in Account B to the VPC endpoint ID.
The correct option is the one that creates a Gateway VPC endpoint for S3 in Account A, configures a customer managed KMS key in Account B with decryption permissions for Account A's IAM role, and configures the S3 bucket policy in Account B to restrict access to the VPC endpoint. AWS-managed keys (like aws/s3) do not support policy modification and cannot be shared across accounts, necessitating a customer managed KMS key. A Gateway VPC endpoint ensures S3 traffic stays within the AWS network and can be restricted in the S3 bucket policy using the VPC endpoint ID.

Adım Adım Çözüm

1
Configure network isolation using a Gateway VPC endpoint in Account A.
A Gateway VPC endpoint for S3 is created and associated with Account A's subnet route tables, routing S3 traffic internally within the AWS network.
To satisfy the requirement that all traffic stays within the AWS network without exposing endpoints to the public internet.
2
Set up a customer managed KMS key in Account B and configure cross-account decryption access.
A new customer managed key is created in Account B with its key policy allowing Account A's IAM role to perform kms:Decrypt. S3 default encryption in Account B is updated to use this key.
AWS-managed KMS keys do not support policy modification and cannot be shared across accounts; therefore, a customer managed key is required to authorize the cross-account decrypt operation.
3
Configure the S3 bucket policy in Account B to grant access restricted to the VPC endpoint.
The S3 bucket policy allows s3:GetObject to Account A's IAM role, with a condition block requiring aws:sourceVpce to match Account A's VPC endpoint ID.
To implement least privilege access and restrict S3 bucket reads to only requests originating from the authorized VPC.

Anahtar Kavram

Cross-account access with KMS encryption and VPC endpoint restriction
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security