Examkin

Soru

Zorluk: ZorSecurity and Compliance Control Design

A retail corporation is designing a new Point of Sale (POS) transaction processing pipeline across multiple accounts under AWS Organizations. The application tier runs on Amazon EC2 instances in a dedicated Ingestion VPC inside the Production Account (111122223333). These instances must upload transaction logs directly to an Amazon S3 bucket located in a centralized Compliance Account (444455556666). The compliance team requires that all uploaded logs be encrypted at rest using a Key Management Service (KMS) key managed exclusively by the compliance team. The ingestion application must be able to encrypt the logs during upload but must be strictly prevented from decrypting the logs once they are written. Furthermore, key administration must be restricted to the Compliance Account, and administrators in the Production Account must not have permissions to modify the key's configuration. Which combination of actions should the Solutions Architect take to design a compliant control structure? (Select TWO.)

  1. In the Compliance Account (444455556666), create a Customer Managed KMS key. Configure the key policy to grant the Production Account (111122223333) IAM role permission to perform the kms:GenerateDataKey and kms:DescribeKey actions, while omitting the kms:Decrypt permission for this role.Cevap
  2. In the Compliance Account (444455556666), configure the S3 bucket policy to grant the Production Account (111122223333) IAM role permission for the s3:PutObject action, and enforce a condition requiring the s3:x-amz-server-side-encryption header to be set to aws:kms referencing the Customer Managed KMS key's Amazon Resource Name (ARN).Cevap
  3. C
    In the Compliance Account (444455556666), configure default S3 bucket encryption using the AWS-managed KMS key for Amazon S3 (aws/s3), and modify its key policy to delegate cross-account encryption and decryption rights to the Production Account (111122223333) IAM role.
  4. D
    Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level containing the Production Account that explicitly grants the EC2 instance profile role cross-account kms:GenerateDataKey permissions for the key in the Compliance Account, overriding local policy constraints.
  5. E
    In the Compliance Account (444455556666), configure the S3 bucket policy to allow anonymous uploads restricted by the aws:PrincipalOrgID condition, and delegate KMS key permission enforcement to an S3 Access Point registered in the Production Account.

Cevap

To achieve secure cross-account logging with proper segregation of duties, the solutions architect must create a Customer Managed Key (CMK) in the Compliance Account and grant the Production Account's IAM role permissions to generate and describe data keys (but not decrypt). Additionally, the Compliance Account S3 bucket policy must grant s3:PutObject to the Production IAM role while enforcing the use of the specific Customer Managed Key ARN using policy condition keys.
The correct combination requires creating a Customer Managed Key (CMK) in the Compliance Account, since only CMKs support the key policy modifications required for cross-account delegation. The key policy must grant key generation and description permissions to the Production Account IAM role while omitting decryption permissions to enforce segregation of duties. Simultaneously, the S3 bucket policy in the Compliance Account must grant PutObject permissions to the Production IAM role and enforce compliance by requiring that all uploads use the specified key via request headers.

Adım Adım Çözüm

1
Determine the correct KMS key type for cross-account sharing.
Identify that a Customer Managed Key (CMK) must be created in the Compliance Account (444455556666) because AWS-managed keys (aws/s3) cannot be shared across accounts.
AWS-managed keys do not permit policy modification, meaning they cannot delegate cross-account access.
2
Enforce segregation of duties in the KMS key policy.
Configure the key policy of the CMK to grant kms:GenerateDataKey and kms:DescribeKey to the Production Account (111122223333) IAM role, but omit kms:Decrypt.
This allows the ingestion application to write and encrypt logs but prevents it from reading or decrypting logs once uploaded.
3
Configure S3 bucket boundary controls.
Write an S3 bucket policy in the Compliance Account allowing s3:PutObject for the Production role with a condition requiring s3:x-amz-server-side-encryption-aws-kms-key-id to match the CMK ARN.
Enforces that all uploaded objects must use the designated compliance key, blocking unencrypted or incorrectly encrypted uploads.

Anahtar Kavram

Cross-account KMS key sharing and S3 bucket access control design
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru