Examkin

Soru

Zorluk: ZorStrengthening Identity, Access, and Network Security

A financial enterprise is refactoring a data processing pipeline that spans multiple AWS accounts. A processing application hosted on Amazon EC2 instances in a private subnet of a production VPC (Account B) has no outbound internet route or NAT Gateway. The instances must read sensitive records from an Amazon S3 bucket in a compliance account (Account A). The S3 bucket is encrypted using a Customer Managed Key (CMK) in Account A. The security team requires that all data transit remain within the AWS network, and the S3 bucket must restrict access to requests originating from the production VPC's S3 Gateway VPC Endpoint. The instances use an IAM role to access the bucket. Currently, attempts to download and decrypt the S3 objects are failing. Which combination of architectural modifications will resolve the access failure while meeting all security requirements?

  1. Deploy an Interface VPC Endpoint for KMS in the production VPC (Account B). In Account A, configure the customer-managed KMS key policy to allow the EC2 instances' IAM role to perform kms:Decrypt, and update the S3 bucket policy to allow the role to perform s3:GetObject with a condition restricting requests to the S3 Gateway VPC Endpoint ID.Cevap
  2. B
    Deploy an Interface VPC Endpoint for KMS in the production VPC (Account B). Update the S3 bucket policy in Account A to use the default AWS-managed S3 key (aws/s3), and configure the key policy of aws/s3 in Account A to allow the EC2 instances' IAM role to perform kms:Decrypt.
  3. C
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account B that explicitly grants the EC2 instances' IAM role cross-account permissions for s3:GetObject and kms:Decrypt against Account A's resources. In Account B, configure the S3 Gateway VPC Endpoint policy to allow KMS transit traffic.
  4. D
    Configure an AWS Transit Gateway between Account A and Account B to route KMS API traffic from Account B's private subnets to Account A. In Account A, configure an AWS Direct Connect Gateway to transitively route these KMS requests to the public AWS KMS service endpoint.

Cevap

Deploy an Interface VPC Endpoint for KMS in the production VPC (Account B). In Account A, configure the customer-managed KMS key policy to allow the EC2 instances' IAM role to perform kms:Decrypt, and update the S3 bucket policy to allow the role to perform s3:GetObject with a condition restricting requests to the S3 Gateway VPC Endpoint ID.
The correct solution involves deploying a KMS Interface VPC Endpoint in Account B because the S3 Gateway VPC Endpoint only routes S3 traffic, leaving the isolated EC2 instances unable to reach the public KMS endpoint to decrypt the downloaded objects. Furthermore, a Customer Managed Key in Account A is required because default AWS-managed keys cannot be shared cross-account, and the S3 bucket policy must explicitly permit the cross-account role while enforcing the S3 Gateway VPC Endpoint source condition.

Adım Adım Çözüm

1
Address the network path for KMS requests.
Create an Interface VPC Endpoint for KMS (com.amazonaws.region.kms) in the production VPC (Account B).
Since the VPC has no internet access or NAT Gateway, and the S3 Gateway VPC Endpoint only routes S3 traffic, a dedicated interface endpoint is required to route KMS decryption requests privately to the AWS KMS service.
2
Configure the cross-account KMS Key Policy.
Modify the customer-managed KMS key policy in Account A to allow the IAM role of the EC2 instances in Account B to perform the kms:Decrypt action.
Cross-account access to KMS keys requires explicit delegation in the key policy of the owning account. AWS-managed keys cannot be used for this purpose.
3
Configure the S3 Bucket Policy with network restrictions.
Update the S3 bucket policy in Account A to allow the IAM role in Account B to perform s3:GetObject, with a condition block checking for the S3 Gateway VPC Endpoint ID using the aws:sourceVpce condition key.
This satisfies the requirement to restrict bucket access to requests originating from the specific S3 Gateway VPC Endpoint in the production VPC.

Anahtar Kavram

Cross-account resource access with KMS encryption requires explicit key policy sharing (using Customer Managed Keys) and network-level configurations (such as Interface VPC Endpoints) when resolving service calls from private, isolated subnets.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security