Examkin

Soru

Zorluk: OrtaSecurity and Compliance Control Design

A financial services company is building a transaction archiving solution on AWS. The architecture is split across two AWS accounts: a Processing Account where an application on Amazon EC2 instances writes daily transaction logs, and a Compliance Account where the logs must be stored in an Amazon S3 bucket. The compliance guidelines dictate that all logs must be encrypted at rest using SSE-KMS with a key managed by the Compliance Account, and the compliance team must automatically own all uploaded log objects. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create a Customer Managed Key (CMK) in the Compliance Account, and configure its key policy to grant the EC2 instance IAM role in the Processing Account permissions to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions.Cevap
  2. Configure the S3 bucket policy in the Compliance Account to grant the EC2 instance IAM role in the Processing Account `s3:PutObject` permission, and set the S3 Object Ownership setting on the bucket to Bucket Owner Enforced.Cevap
  3. C
    Use the default AWS-managed KMS key for S3 (`aws/s3`) in the Compliance Account, and configure its key policy to allow the EC2 instance IAM role in the Processing Account to encrypt and decrypt the logs.
  4. D
    Attach a Service Control Policy (SCP) to the Processing Account's Organizational Unit (OU) that explicitly grants `s3:PutObject` and `kms:GenerateDataKey` permissions to the EC2 instance IAM role, without configuring local IAM policies in the Processing Account.
  5. E
    Configure the S3 bucket policy in the Compliance Account by specifying the Processing Account's ID in the Resource block of the policy instead of the Principal block, relying on the S3 bucket policy to automatically authorize the EC2 instance IAM role.

Cevap

Create a Customer Managed Key (CMK) in the Compliance Account and configure its key policy to grant the EC2 instance IAM role in the Processing Account permissions to perform the `kms:GenerateDataKey` and `kms:Decrypt` actions, and configure the S3 bucket policy in the Compliance Account to grant the EC2 instance IAM role in the Processing Account `s3:PutObject` permission, while setting the S3 Object Ownership setting on the bucket to Bucket Owner Enforced.
To set up secure cross-account uploads with encryption, you must use a Customer Managed Key (CMK) because the default AWS-managed KMS keys do not support policy modification for cross-account access. The key policy of the CMK must grant the external EC2 instance IAM role permissions for `kms:GenerateDataKey` and `kms:Decrypt`. Additionally, the S3 bucket policy must allow the EC2 instance IAM role to perform `s3:PutObject`, and the S3 Object Ownership setting on the bucket must be configured as Bucket Owner Enforced. This automatically transfers ownership of all uploaded objects to the bucket owner and disables ACLs.

Adım Adım Çözüm

1
Select the correct KMS key type for cross-account encryption.
Identify that a Customer Managed Key (CMK) is required because AWS-managed keys (`aws/s3`) cannot have their key policies modified for cross-account delegation.
KMS cross-account access requires explicit permission delegation in the key policy.
2
Configure the S3 bucket policy and Object Ownership settings in the Compliance Account.
Write a bucket policy targeting the EC2 instance IAM role in the Processing Account for `s3:PutObject` access, and configure S3 Object Ownership to Bucket Owner Enforced.
This grants write permissions across accounts while transferring ownership of the uploaded files to the destination bucket owner.

Anahtar Kavram

Cross-account resource sharing using S3 bucket policies, KMS key policies, and S3 Object Ownership configuration.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru