Examkin

Soru

Zorluk: ZorEnhancing Data Protection and Compliance

A healthcare provider has a multi-account AWS environment managed under AWS Organizations. An existing application in several member accounts uploads medical imaging data to a centralized Amazon S3 bucket in a dedicated compliance account. The S3 bucket currently uses the default AWS-managed KMS key (aws/s3) for server-side encryption. A security audit requires the provider to implement cross-account access so that authorized IAM roles in the member accounts can retrieve and decrypt the objects. Additionally, the solution must adhere to the principle of least privilege. Which configuration change should the solutions architect implement to meet these requirements?

  1. A
    Retain the AWS-managed KMS key (aws/s3) for default encryption on the centralized S3 bucket. Update the S3 bucket policy in the compliance account to grant read and write permissions to the member accounts, and configure the member accounts' IAM policies to allow kms:Decrypt and kms:GenerateDataKey on the AWS-managed key.
  2. Create a customer-managed KMS key in the compliance account and configure the S3 bucket to use it. Update the KMS key policy to grant the member accounts' IAM roles permissions to perform kms:Decrypt and kms:GenerateDataKey. Update the S3 bucket policy in the compliance account to allow the member accounts' IAM roles to perform s3:PutObject and s3:GetObject.Cevap
  3. C
    Create a customer-managed KMS key in the compliance account and configure the S3 bucket to use it. Attach an AWS Organizations Service Control Policy (SCP) at the Root level that explicitly allows the member accounts' IAM roles to perform kms:Decrypt and kms:GenerateDataKey on the new KMS key in the compliance account, without modifying the key policy.
  4. D
    Create a customer-managed KMS key in the compliance account and configure the S3 bucket to use it. Update the KMS key policy to grant the member accounts' IAM roles permissions to perform kms:Decrypt and kms:GenerateDataKey, but do not update the S3 bucket policy, relying instead on member account IAM policies for S3 bucket access.

Cevap

Create a customer-managed KMS key in the compliance account and configure the S3 bucket to use it. Update the KMS key policy to grant the member accounts' IAM roles permissions to perform kms:Decrypt and kms:GenerateDataKey. Update the S3 bucket policy in the compliance account to allow the member accounts' IAM roles to perform s3:PutObject and s3:GetObject.
The correct configuration establishes a customer-managed key (CMK) in the compliance account. Unlike AWS-managed keys, CMKs allow key policies to be modified, enabling the compliance account to delegate decryption and data key generation permissions to member account IAM roles. Additionally, it configures the destination S3 bucket policy to grant read/write access to the cross-account roles, completing the required authorization loop for cross-account S3 operations.

Adım Adım Çözüm

1
Evaluate the key type configuration.
Identify that the default AWS-managed KMS key (aws/s3) cannot be shared across accounts because its key policy cannot be modified.
AWS-managed keys have fixed key policies that prevent cross-account delegation.
2
Transition to a customer-managed key (CMK).
Create a customer-managed key in the compliance account and configure the S3 bucket to use it.
Customer-managed keys support policy customization, enabling the owner account to delegate access to other accounts.
3
Update the key policy and bucket policy.
Update the CMK policy to allow cross-account IAM roles the kms:Decrypt and kms:GenerateDataKey actions, and update the S3 bucket policy to allow s3:GetObject and s3:PutObject actions.
Cross-account access to encrypted S3 resources requires explicit permissions in both the resource policy (S3 bucket policy), the key policy (KMS key policy), and the caller's IAM policies.

Anahtar Kavram

Cross-Account Access to S3 and KMS CMKs
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Enhancing Data Protection and Compliance