Soru

Zorluk: OrtaSecurity and Compliance Control Design

A financial services company is designing a new compliance reporting pipeline. A data ingestion application running on Amazon EC2 instances in a Production account (Account ID 111111111111111111111111) must write monthly transaction reports directly to an Amazon S3 bucket located in a dedicated Security and Auditing account (Account ID 222222222222222222222222). All objects written to the destination S3 bucket must be encrypted at rest using Server-Side Encryption with AWS KMS (SSE-KMS) to meet PCI-DSS requirements. Which combination of S3 and KMS configuration will successfully allow the application to write encrypted reports to the bucket?

  1. Configure the destination S3 bucket to use a customer managed KMS key in the Security and Auditing account. Modify the key policy of this customer managed KMS key to grant the Production application's IAM role permission to perform the kms:GenerateDataKey and kms:Decrypt actions. Configure the destination S3 bucket policy to allow the Production application's IAM role to perform the s3:PutObject action. Attach an IAM policy to the Production application's IAM role that grants permissions to write to the S3 bucket and use the customer managed KMS key.Cevap
  2. B
    Configure the destination S3 bucket to use the default AWS managed key (aws/s3) in the Security and Auditing account. Modify the destination S3 bucket policy to grant the Production application's IAM role permission to perform the s3:PutObject action. Attach an IAM policy to the Production application's IAM role that allows writing to the S3 bucket and performing cryptographic operations on the aws/s3 key.
  3. C
    Configure the destination S3 bucket to use a customer managed KMS key in the Security and Auditing account. Apply a Service Control Policy (SCP) to the Organizational Unit containing the Security and Auditing account that explicitly allows the Production application's IAM role to write to the bucket and access the KMS key. Rely on this SCP to grant cross-account permissions without modifying the KMS key policy or the destination S3 bucket policy.
  4. D
    Configure the destination S3 bucket to use a customer managed KMS key in the Security and Auditing account. Modify the key policy of this customer managed KMS key to grant the Production application's IAM role permission to perform the kms:GenerateDataKey and kms:Decrypt actions. Attach an IAM policy to the Production application's IAM role that grants permissions to write to the S3 bucket and use the customer managed KMS key, while keeping the destination S3 bucket policy private without explicit cross-account permissions.

Cevap

Configure the destination S3 bucket to use a customer managed KMS key in the Security and Auditing account. Modify the key policy of this customer managed KMS key to grant the Production application's IAM role permission to perform the kms:GenerateDataKey and kms:Decrypt actions. Configure the destination S3 bucket policy to allow the Production application's IAM role to perform the s3:PutObject action. Attach an IAM policy to the Production application's IAM role that grants permissions to write to the S3 bucket and use the customer managed KMS key.
The correct configuration uses a customer managed KMS key, updates its key policy to allow the Production role to generate a data key, updates the destination S3 bucket policy to allow the Production role to write objects, and configures the caller's local IAM policy. This satisfies all cross-account permission checks on AWS.

Adım Adım Çözüm

1
Determine the KMS key type requirement for cross-account encryption.
Identify that AWS managed keys cannot be shared cross-account, meaning a customer managed KMS key must be created in the destination account (Security and Auditing account).
AWS managed KMS keys have read-only key policies that cannot be modified to delegate access to external account identities.
2
Configure the key policy for the customer managed KMS key.
Add a policy statement to the key in the Security and Auditing account that allows the Production IAM role principal to call kms:GenerateDataKey and kms:Decrypt.
When uploading objects to S3 with SSE-KMS, the caller needs to generate a data key to encrypt the payload.
3
Configure the S3 bucket policy in the Security and Auditing account.
Add a policy statement to the destination S3 bucket allowing s3:PutObject for the Production IAM role principal.
Cross-account resource access requires the destination resource's resource-based policy to explicitly trust and authorize the external identity.
4
Configure the IAM policy in the Production account.
Attach an IAM policy to the Production application's role allowing s3:PutObject on the destination S3 bucket and kms:GenerateDataKey/kms:Decrypt on the customer managed KMS key.
Cross-account access requires permissions to be granted in both the caller's IAM policy and the destination's resource-based policies.

Anahtar Kavram

Cross-account access with KMS encryption requires explicit authorization in the KMS key policy, destination S3 bucket policy, and source IAM identity policy, and is only supported with Customer Managed Keys.
Tahmini Süre:1m 30s
Bu soruyu puanla