Examkin

Soru

Zorluk: OrtaEnhancing Data Protection and Compliance

A biotechnology company has an existing application running in a Production AWS account that writes sensitive genomic datasets to an Amazon S3 bucket located in a separate Compliance AWS account. The S3 bucket currently encrypts data at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). To satisfy new regulatory audits, the company must enhance its data protection posture. All datasets must be encrypted at rest using a Customer Managed Key (CMK) with automatic annual rotation enabled. Furthermore, all key usage for decryption must be auditable, and the application in the Production account must be able to perform these operations securely. Which configuration should a solutions architect implement to meet these requirements?

  1. A
    Configure the S3 bucket in the Compliance account to use the default AWS-managed KMS key (aws/s3). Update the IAM policy of the application role in the Production account to grant permissions for the kms:GenerateDataKey and kms:Decrypt actions on the Compliance account's aws/s3 key.
  2. B
    Create a symmetric Customer Managed Key (CMK) in the Compliance account. Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the Production account to explicitly grant the application IAM role permissions to perform kms:GenerateDataKey and kms:Decrypt on the CMK in the Compliance account.
  3. C
    Create a symmetric Customer Managed Key (CMK) in the Compliance account. Add a statement to the S3 bucket policy in the Compliance account that grants the Production account's IAM role permissions to perform the kms:GenerateDataKey and kms:Decrypt actions, without modifying the CMK's key policy.
  4. Create a symmetric Customer Managed Key (CMK) in the Compliance account. Configure the CMK's key policy in the Compliance account to grant the Production account's application IAM role permissions for the kms:GenerateDataKey and kms:Decrypt actions. Grant the Production account's application IAM role permissions to perform the same actions on the CMK in its local IAM policy. Configure the S3 bucket in the Compliance account to use this CMK as the default encryption key.Cevap

Cevap

Create a symmetric Customer Managed Key (CMK) in the Compliance account, configure the CMK's key policy to trust the Production account's application IAM role, grant corresponding local IAM permissions in the Production account, and configure the S3 bucket default encryption to use this CMK.
Creating a symmetric Customer Managed Key (CMK) in the destination (Compliance) account allows the key owner to manage the key's policy, enabling secure cross-account delegation. The key policy must explicitly trust the external (Production) account's IAM role for KMS cryptographic operations (kms:GenerateDataKey and kms:Decrypt). In addition, the caller's IAM policy in the Production account must also grant permission to use the external CMK. Enabling default bucket encryption on the S3 bucket with this CMK ensures all new objects are encrypted automatically, and key access logs in CloudTrail provide the required auditing.

Adım Adım Çözüm

1
Create a Customer Managed Key (CMK) in the Compliance account.
A KMS key is generated whose policy can be fully customized by the administrator.
Unlike AWS-managed keys, CMKs support custom key policies that can be configured to delegate access to external AWS accounts.
2
Configure the CMK key policy in the Compliance account and the application's IAM policy in the Production account.
The application role is authorized to perform cryptographic operations (kms:GenerateDataKey, kms:Decrypt) using the Compliance account's CMK.
Cross-account access in AWS KMS requires trust to be configured on both sides: the key policy must grant permissions to the external principal, and the external principal's IAM policy must grant permissions to use the key.
3
Configure the S3 bucket default encryption to use the newly created CMK.
All new objects written to the S3 bucket are automatically encrypted using the Customer Managed Key.
Enabling S3 default encryption ensures compliance without requiring the application to explicitly define encryption parameters on every upload request.

Anahtar Kavram

Cross-account AWS KMS key sharing requires two-way authorization: a key policy update in the hosting account to delegate access, and an IAM policy update in the calling account to allow usage. AWS-managed keys cannot be shared cross-account because their key policies cannot be modified.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Enhancing Data Protection and Compliance