A biotechnology firm, BioGenetics Labs, is building a genomic analysis pipeline. The raw sequencing data is ingested into an Amazon S3 bucket in the Ingestion account (). The data must be replicated automatically to an S3 bucket in a dedicated Compliance and Archival account () within the same AWS Organization. The compliance requirements specify that all objects must be encrypted at rest in both source and destination buckets using AWS KMS, the Ingestion account must not retain permission to read or delete the replicated objects once they are in the Compliance account, and access to decrypt the replicated data in the Compliance account must be restricted strictly to users within the Compliance account. Which of the following designs meets these security and compliance requirements?
- Configure Amazon S3 cross-account replication with the replica ownership override option enabled. In the Compliance account, configure the destination bucket to encrypt objects using a Customer Managed Key (CMK). Modify the key policy of this CMK to grant the Ingestion replication IAM role permissions for the kms:GenerateDataKey and kms:Encrypt actions. In the Ingestion account, grant the replication IAM role permissions to decrypt with the source KMS key and to encrypt and generate data keys with the destination CMK.Cevap
- BConfigure Amazon S3 cross-account replication with the replica ownership override option enabled. In the Compliance account, configure the destination bucket to encrypt objects using the default AWS-managed KMS key (aws/s3). Modify the key policy of this AWS-managed KMS key to grant the Ingestion replication IAM role permissions for the kms:GenerateDataKey and kms:Encrypt actions. In the Ingestion account, grant the replication role permissions to decrypt with the source key and encrypt with the destination AWS-managed key.
- CConfigure Amazon S3 cross-account replication. In the Compliance account, configure the destination bucket to encrypt objects using a Customer Managed Key (CMK). Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing both accounts that explicitly allows cross-account S3 replication and KMS encryption actions, thereby delegating access to the replication role without requiring key policy or IAM policy updates in the Compliance account.
- DConfigure Amazon S3 cross-account replication. In the Compliance account, configure the destination bucket policy to allow the Ingestion account's replication IAM role to perform s3:ReplicateObject and s3:ReplicateDelete. Deny s3:GetObject to the Ingestion account in the destination bucket policy, but do not configure replica ownership override or modify the Compliance account's Customer Managed Key (CMK) policy, relying on the bucket policy to enforce data boundaries.
Cevap
Configure Amazon S3 cross-account replication with the replica ownership override option enabled. In the Compliance account, configure the destination bucket to encrypt objects using a Customer Managed Key (CMK). Modify the key policy of this CMK to grant the Ingestion replication IAM role permissions for the kms:GenerateDataKey and kms:Encrypt actions. In the Ingestion account, grant the replication IAM role permissions to decrypt with the source KMS key and to encrypt and generate data keys with the destination CMK.
The correct design uses a Customer Managed Key (CMK) in the Compliance account because its key policy can be modified to trust the replication IAM role from the Ingestion account. By enabling replica ownership override, the ownership of the replicated objects transfers to the Compliance account, which allows the Compliance account's bucket and key policies to dictate access. Since the destination CMK's key policy does not grant decrypt permissions to the Ingestion account, users in the Ingestion account will be unable to read the data once it has been replicated, satisfying all compliance constraints.
Adım Adım Çözüm
Anahtar Kavram
Cross-account AWS KMS access delegation and S3 replica ownership management for security boundary enforcement.