A financial services company is designing a new compliance reporting pipeline. A data ingestion application running on Amazon EC2 instances in a Production account (Account ID ) must write monthly transaction reports directly to an Amazon S3 bucket located in a dedicated Security and Auditing account (Account ID ). All objects written to the destination S3 bucket must be encrypted at rest using Server-Side Encryption with AWS KMS (SSE-KMS) to meet PCI-DSS requirements. Which combination of S3 and KMS configuration will successfully allow the application to write encrypted reports to the bucket?
- Configure the destination S3 bucket to use a customer managed KMS key in the Security and Auditing account. Modify the key policy of this customer managed KMS key to grant the Production application's IAM role permission to perform the kms:GenerateDataKey and kms:Decrypt actions. Configure the destination S3 bucket policy to allow the Production application's IAM role to perform the s3:PutObject action. Attach an IAM policy to the Production application's IAM role that grants permissions to write to the S3 bucket and use the customer managed KMS key.Cevap
- BConfigure the destination S3 bucket to use the default AWS managed key (aws/s3) in the Security and Auditing account. Modify the destination S3 bucket policy to grant the Production application's IAM role permission to perform the s3:PutObject action. Attach an IAM policy to the Production application's IAM role that allows writing to the S3 bucket and performing cryptographic operations on the aws/s3 key.
- CConfigure the destination S3 bucket to use a customer managed KMS key in the Security and Auditing account. Apply a Service Control Policy (SCP) to the Organizational Unit containing the Security and Auditing account that explicitly allows the Production application's IAM role to write to the bucket and access the KMS key. Rely on this SCP to grant cross-account permissions without modifying the KMS key policy or the destination S3 bucket policy.
- DConfigure the destination S3 bucket to use a customer managed KMS key in the Security and Auditing account. Modify the key policy of this customer managed KMS key to grant the Production application's IAM role permission to perform the kms:GenerateDataKey and kms:Decrypt actions. Attach an IAM policy to the Production application's IAM role that grants permissions to write to the S3 bucket and use the customer managed KMS key, while keeping the destination S3 bucket policy private without explicit cross-account permissions.
Cevap
Configure the destination S3 bucket to use a customer managed KMS key in the Security and Auditing account. Modify the key policy of this customer managed KMS key to grant the Production application's IAM role permission to perform the kms:GenerateDataKey and kms:Decrypt actions. Configure the destination S3 bucket policy to allow the Production application's IAM role to perform the s3:PutObject action. Attach an IAM policy to the Production application's IAM role that grants permissions to write to the S3 bucket and use the customer managed KMS key.
The correct configuration uses a customer managed KMS key, updates its key policy to allow the Production role to generate a data key, updates the destination S3 bucket policy to allow the Production role to write objects, and configures the caller's local IAM policy. This satisfies all cross-account permission checks on AWS.
Adım Adım Çözüm
Anahtar Kavram
Cross-account access with KMS encryption requires explicit authorization in the KMS key policy, destination S3 bucket policy, and source IAM identity policy, and is only supported with Customer Managed Keys.
Tahmini Süre:1m 30s