A financial services company is designing a new compliance auditing architecture using AWS Organizations. The security team operates from a centralized Audit account (111122223333) and must analyze sensitive transaction logs stored in an Amazon S3 bucket within a separate Production account (444455556666). The logs must be encrypted at rest. The solution must enforce the principle of least privilege, allowing only the auditing IAM role AuditReaderRole in the Audit account to read the logs, while preventing any other access. Which configuration will successfully enable this cross-account access while meeting the security requirements?
- Configure the Amazon S3 bucket in the Production account to use server-side encryption with an AWS KMS customer managed key (CMK). In the Production account, configure the CMK's key policy to allow kms:Decrypt permissions for AuditReaderRole in the Audit account, and configure the S3 bucket policy to allow s3:GetObject permissions for AuditReaderRole. In the Audit account, attach an IAM policy to AuditReaderRole that grants s3:GetObject on the S3 bucket and kms:Decrypt on the CMK.Cevap
- BConfigure the Amazon S3 bucket in the Production account to use server-side encryption with the default AWS managed key (aws/s3). In the Production account, configure the S3 bucket policy to allow s3:GetObject permissions for AuditReaderRole in the Audit account. In the Audit account, attach an IAM policy to AuditReaderRole that grants s3:GetObject on the S3 bucket and kms:Decrypt on the AWS managed key (aws/s3).
- CConfigure the Amazon S3 bucket in the Production account to use server-side encryption with an AWS KMS customer managed key (CMK). Attach a Service Control Policy (SCP) at the root of the AWS Organization that allows AuditReaderRole in the Audit account to perform s3:GetObject on the Production S3 bucket and kms:Decrypt on the CMK. In the Production account, configure the S3 bucket policy and the CMK key policy to allow access from the entire AWS Organization.
- DConfigure the Amazon S3 bucket in the Production account to use server-side encryption with an AWS KMS customer managed key (CMK). In the Production account, configure the S3 bucket policy to allow s3:GetObject permissions for the Audit account ID (111122223333). In the Audit account, attach an IAM policy to AuditReaderRole that grants s3:GetObject on the Production S3 bucket and kms:Decrypt on the Production CMK. Do not modify the KMS key policy in the Production account, as the IAM policy in the Audit account is sufficient to delegate the KMS decryption permission.
Cevap
Configure the S3 bucket to use a customer managed key (CMK), update the CMK's key policy and the S3 bucket policy in the Production account to trust the external role, and attach an IAM policy to the role in the Audit account permitting both S3 read and KMS decryption operations.
The correct solution involves using an AWS KMS customer managed key (CMK) because AWS managed keys (such as aws/s3) do not allow modification of their key policies to grant cross-account permissions. The resource owner must update both the S3 bucket policy and the CMK key policy to trust the target role. Additionally, the caller account must attach an IAM policy to the target role allowing it to read the S3 bucket and decrypt using the CMK. This creates the necessary trust chain for secure, least-privilege cross-account access.
Adım Adım Çözüm
Anahtar Kavram
Cross-account access to S3 buckets encrypted with custom KMS keys requires explicit configuration in the S3 bucket policy, the KMS key policy, and the caller's IAM policy, and must utilize a customer managed key.
Tahmini Süre:2m 30s