Examkin

Soru

Zorluk: KolayEnhancing Data Protection and Compliance

A financial company hosts an application that stores sensitive transaction reports in an Amazon S3 bucket. To comply with data protection regulations, the objects are encrypted using the default AWS-managed KMS key (aws/s3). The company now needs to grant read-only access to these S3 objects to an external auditing team operating in a separate AWS account. The external team is currently blocked when attempting to read the objects, despite having the correct S3 permissions. Which of the following is the most appropriate action to resolve this issue and securely allow cross-account access?

  1. Create a customer managed KMS key, re-encrypt the S3 objects using this new key, and update its key policy to grant the external AWS account's role permission to use the key.Cevap
  2. B
    Modify the key policy of the default AWS-managed KMS key (aws/s3) to grant decrypt permissions to the IAM role used by the external auditing team.
  3. C
    Create a Service Control Policy (SCP) at the root level of the AWS Organization that allows the external account's role to access the default AWS-managed KMS key (aws/s3).
  4. D
    Add a statement to the S3 bucket policy in the source account that delegates kms:Decrypt permissions to the external account principal for the default AWS-managed KMS key (aws/s3).

Cevap

Create a customer managed KMS key, re-encrypt the S3 objects using this new key, and update its key policy to grant the external AWS account's role permission to use the key.
For cross-account access to encrypted S3 objects, the external role must have permissions on the S3 bucket and decrypt permissions on the KMS key. Because default AWS-managed KMS keys (aws/s3) cannot be shared across accounts and their key policies cannot be modified, a customer managed key must be used. Re-encrypting the objects with a customer managed KMS key and allowing the external account's IAM role in its key policy successfully solves the issue.

Adım Adım Çözüm

1
Identify the KMS key encryption constraint.
Identify that the S3 objects are encrypted with a default AWS-managed KMS key (aws/s3), which cannot be modified or shared cross-account.
Determines why the external auditing team is blocked despite having correct S3 bucket permissions.
2
Create a customer managed KMS key.
A new customer managed key is created in the source account, which supports custom key policies.
Enables configuration of cross-account access via the key policy.
3
Modify the key policy and S3 permissions.
Grant decrypt permissions on the customer managed key to the external account's role and re-encrypt S3 objects.
Allows the external role to perform both s3:GetObject and kms:Decrypt operations required to access the files.

Anahtar Kavram

Cross-account AWS KMS access rules and limitations of default AWS-managed KMS keys.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Enhancing Data Protection and Compliance