Examkin

Soru

Zorluk: KolaySecurity and Compliance Control Design

An enterprise is designing a secure storage solution where an application running in Account B must read encrypted objects from an Amazon S3 bucket located in Account A. The objects in the S3 bucket must be encrypted at rest using AWS KMS.

Which two configuration steps are required to enable this cross-account access? (Select TWO.)

  1. Create a customer managed key in Account A, and configure its key policy to allow the IAM role in Account B to perform the kms:Decrypt action.Cevap
  2. Configure the IAM policy attached to the application's IAM role in Account B to allow the kms:Decrypt action on the ARN of the KMS key in Account A.Cevap
  3. C
    Use the default AWS-managed key for Amazon S3 (aws/s3) in Account A and modify its key policy to grant decrypt permissions to the IAM role in Account B.
  4. D
    Attach a Service Control Policy (SCP) to the AWS Organization root that grants Account B direct access to Account A's KMS keys, removing the need for local IAM or KMS policies.
  5. E
    Create a trust relationship on Account A's KMS key policy using the sts:AssumeRoleWithSAML action to federate the Account B identity directly.

Cevap

To configure cross-account access to KMS-encrypted objects, you must create a Customer Managed Key in Account A, configure its key policy to allow the IAM role in Account B to decrypt, and attach an IAM policy to the IAM role in Account B that permits the decrypt action on the KMS key.
Cross-account AWS KMS access requires configuring permissions on both the resource policy (the KMS key policy in Account A) and the identity-based policy (the IAM policy in Account B). Additionally, you must use a Customer Managed Key (CMK) because the default AWS-managed keys (such as aws/s3) cannot be shared across accounts as their key policies are immutable.

Adım Adım Çözüm

1
Select a customer managed key for encryption in Account A.
You have a key that supports custom key policy modifications, unlike the default AWS-managed aws/s3 key.
AWS-managed keys cannot be shared across accounts because their key policies cannot be modified.
2
Modify the customer managed key policy in Account A.
The key policy explicitly lists Account B's IAM role as an authorized principal for the kms:Decrypt action.
For cross-account access, the resource-based policy (the key policy) must explicitly authorize the external account principal.
3
Configure the IAM policy for the application's role in Account B.
The application's role has permission to call kms:Decrypt on Account A's KMS key ARN.
For cross-account access, permissions must be granted on both sides: the key policy in the trust/source account and the identity-based policy in the trusted/destination account.

Anahtar Kavram

Cross-account access to KMS keys requires using Customer Managed Keys (CMKs) and configuring permissions on both the KMS key policy in the source account and the IAM policy in the destination account.
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru