An international logistics firm is designing a new transit tracking pipeline. The system deploys an ingestion service running on Amazon ECS tasks in AWS Account A (). The service must write shipment telemetry data directly into an Amazon S3 bucket located in Account B ().
The compliance guidelines dictate:
1. All telemetry data at rest in the destination bucket must be encrypted using a Customer Managed Key (CMK) managed in Account B.
2. The destination bucket must deny any upload that is unencrypted or uses an incorrect key.
3. Access control lists (ACLs) must be disabled on the destination bucket, ensuring the bucket owner automatically owns all uploaded data.
Which combination of configuration steps will securely achieve this architecture?
- AIn Account B, set the S3 bucket's Object Ownership to Bucket Owner Enforced. Configure the destination S3 bucket to use the default AWS-managed KMS key (`aws/s3`) for encryption. Configure the bucket policy to grant `s3:PutObject` to the ECS task role in Account A, and configure Account A's IAM policy to allow the role to use the default AWS-managed key across accounts.
- BIn the AWS Organizations management account, create a Service Control Policy (SCP) that grants the ECS task role in Account A `s3:PutObject` on the Account B bucket and `kms:GenerateDataKey` on the CMK in Account B. Attach the SCP to Account A's organizational unit. In Account A, verify the ECS task role has no local IAM restrictions and write to the bucket directly.
- In Account B, set the S3 bucket's Object Ownership to Bucket Owner Enforced. Configure the S3 bucket policy to allow the ECS task role in Account A to perform `s3:PutObject`, denying requests without `s3:x-amz-server-side-encryption` set to `aws:kms` and referencing the CMK ARN. In Account B, update the CMK key policy to allow the ECS task role in Account A to perform `kms:GenerateDataKey` and `kms:Decrypt`. In Account A, grant the ECS task role permissions to perform `s3:PutObject` on the bucket and `kms:GenerateDataKey` on the CMK in Account B.Cevap
- DIn Account B, set the S3 bucket's Object Ownership to Bucket Owner Enforced. Configure the S3 bucket policy to allow the root user of Account A to perform `s3:PutObject`. In Account A, grant the ECS task role permissions to perform `s3:PutObject` and `kms:GenerateDataKey` on Account B's resources, without modifying the KMS key policy in Account B, relying on cross-account IAM delegation.
Cevap
In Account B, set the S3 bucket's Object Ownership to Bucket Owner Enforced. Configure the S3 bucket policy to allow the ECS task role in Account A to perform `s3:PutObject`, denying requests without `s3:x-amz-server-side-encryption` set to `aws:kms` and referencing the CMK ARN. In Account B, update the CMK key policy to allow the ECS task role in Account A to perform `kms:GenerateDataKey` and `kms:Decrypt`. In Account A, grant the ECS task role permissions to perform `s3:PutObject` on the bucket and `kms:GenerateDataKey` on the CMK in Account B.
The correct solution satisfies all architectural and security requirements. Setting the S3 bucket's Object Ownership to Bucket Owner Enforced disables ACLs and guarantees that Account B owns all objects uploaded to the bucket. To allow the ECS task role in Account A to write to the bucket and encrypt using the CMK in Account B, permissions must be granted on both sides: the ECS task role must have identity-based permissions (IAM) in Account A to perform these operations, and the resources in Account B (the S3 bucket policy and the KMS key policy) must explicitly authorize the external ECS task role. Finally, enforcing that all uploads specify the correct encryption parameters in the S3 bucket policy ensures that non-compliant uploads are rejected.
Adım Adım Çözüm
Anahtar Kavram
Cross-account security controls using S3 bucket policies, KMS key policies, and IAM roles.
Tahmini Süre:3m 0s