Examkin

Soru

Zorluk: OrtaEnhancing Data Protection and Compliance

A SaaS provider has a multi-account AWS environment managed via AWS Organizations. Application data containing customer PII is stored in S3 buckets across multiple member accounts in a production Organization Unit (OU). A security audit demands the following improvements:

1. All data stored in these S3 buckets must be encrypted at rest using encryption keys where the lifecycle, rotation, and access policies can be managed by the customer.
2. Member accounts must deliver their S3 server access logs to a centralized S3 bucket located in a dedicated Security account.

Which two actions should the Solutions Architect take to meet these compliance requirements? (Select TWO.)

  1. In each member account, create a Customer Managed KMS Key (CMK) and configure its key policy to grant usage permissions to local IAM roles. Configure the member S3 buckets to use this CMK for server-side encryption (SSE-KMS).Cevap
  2. In the Security account, configure the centralized logging S3 bucket policy to allow the 'logging.s3.amazonaws.com' service principal to perform 's3:PutObject' actions, filtering by the specific source buckets and paths.Cevap
  3. C
    In each member account, configure the S3 buckets to use the default AWS-managed KMS key ('aws/s3') and configure a key policy on the managed key to allow cross-account auditing from the Security account.
  4. D
    Create a Service Control Policy (SCP) that grants cross-account S3 write access to the central logging bucket, and attach it to the production Organization Unit (OU) to automatically authorize log delivery from member accounts.
  5. E
    In the Security account, configure the centralized logging S3 bucket policy to grant 's3:PutObject' permissions to the root principals ('arn:aws:iam::[AccountID]:root') of the production member accounts.

Cevap

Create customer managed KMS keys in each member account and configure key policies to allow local IAM roles to access them for S3 server-side encryption. In the centralized logging Security account, configure the S3 bucket policy to allow the S3 logging service principal (logging.s3.amazonaws.com) to perform s3:PutObject actions.
To encrypt data with customer-manageable lifecycle and access, customer managed keys (CMKs) are required. Standard AWS-managed keys (like aws/s3) do not allow policy customization or cross-account access delegation. For S3 server access logging, the logs are delivered by the Amazon S3 service principal (logging.s3.amazonaws.com) rather than the member accounts' IAM principals. The centralized bucket's policy must therefore trust this service principal to write the log files.

Adım Adım Çözüm

1
Evaluate key management options for S3 encryption at rest to meet customer control requirements.
Identify that Customer Managed Keys (CMKs) must be used since AWS-managed keys (aws/s3) do not allow policy customization or cross-account access.
AWS-managed keys are locked down and cannot be shared or modified, failing the requirement for customer-managed access policies.
2
Determine the proper principal for writing S3 server access logs to a centralized bucket.
Identify the Amazon S3 service principal (logging.s3.amazonaws.com) as the writer of access logs.
S3 server access logs are delivered by the service itself, meaning the bucket policy in the logging account must trust the service principal rather than individual IAM identities.
3
Draft and configure the S3 bucket policy for centralized logging and the KMS key policy for S3 encryption.
Configure a bucket policy allowing s3:PutObject for logging.s3.amazonaws.com and set S3 buckets to use CMK encryption.
This establishes a secure, compliant architecture with fully auditable and segregated encryption keys and log delivery routes.

Anahtar Kavram

Implementing secure encryption at rest using customer managed keys and establishing cross-account centralized S3 logging using service principals.
Bu soruyu puanla

Konular

Enhancing Data Protection and Compliance