Examkin

Soru

Zorluk: OrtaSecurity and Compliance Control Design

A healthcare provider is designing a new medical imaging analysis solution. The ingestion tier runs on Amazon ECS tasks in an Ingestion account (Account A). The processed high-resolution images must be securely stored in an Amazon S3 bucket within a centralized Archiving account (Account B) under HIPAA compliance. The images must be encrypted at rest using a customer managed key (CMK) in AWS Key Management Service (AWS KMS). The solution must ensure that only ECS tasks in Account A can upload files and perform cryptographic operations using the CMK. Which two actions should the Solutions Architect perform to implement this secure cross-account storage and encryption architecture? (Select TWO.)

  1. A
    In the Archiving account (Account B), configure the S3 bucket default encryption to use the AWS managed key (aws/s3) and modify its policy to delegate usage permissions to the ECS task IAM role in the Ingestion account (Account A).
  2. In the Archiving account (Account B), create a customer managed KMS key and configure its key policy to grant the ECS task IAM role in the Ingestion account (Account A) permissions to perform the kms:GenerateDataKey and kms:Decrypt actions.Cevap
  3. C
    Create a Service Control Policy (SCP) in the AWS Organizations management account that grants s3:PutObject and kms:GenerateDataKey permissions to the Ingestion account (Account A) OU, eliminating the need for local IAM policies.
  4. In the Archiving account (Account B), configure the S3 bucket policy to allow the IAM role of the ECS tasks in the Ingestion account (Account A) to perform s3:PutObject and s3:GetObject actions.Cevap
  5. E
    In the Archiving account (Account B), configure the S3 bucket policy to allow public access (Principal: "*") while using a bucket condition to restrict access based on the source VPC ID from the Ingestion account (Account A).

Cevap

Create a customer managed KMS key in the archiving account and configure its key policy to allow the external ECS task IAM role to perform cryptographic operations. Additionally, configure the S3 bucket policy in the archiving account to allow the external ECS task IAM role to perform the required S3 actions.
To secure cross-account workloads that use S3 buckets encrypted with KMS keys, you must create a customer managed KMS key in the destination account because AWS-managed keys cannot be shared cross-account. You must then configure both the KMS key policy and the S3 bucket policy in the destination account to explicitly authorize the IAM role of the client task in the source account.

Adım Adım Çözüm

1
Select a customer managed KMS key instead of an AWS managed key.
Enables the ability to edit the key policy for cross-account access delegation.
AWS managed KMS keys (like aws/s3) cannot be shared across accounts as their key policies are immutable.
2
Configure the key policy of the customer managed KMS key in Account B.
Grants the ECS task IAM role in Account A permission to generate data keys and decrypt.
Without KMS key policy authorization, the external principal cannot perform the cryptographic operations required to upload and download encrypted files.
3
Configure the S3 bucket policy in Account B.
Grants the ECS task IAM role in Account A permission to perform S3 actions.
For cross-account S3 operations, the bucket policy in the destination account must explicitly permit the external IAM principal.

Anahtar Kavram

Cross-account access delegation for encrypted S3 buckets requires using Customer Managed Keys (CMKs) rather than AWS Managed Keys, combined with both S3 bucket policy and KMS key policy authorization targeting the external IAM identity.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru