Examkin

Soru

Zorluk: OrtaStrengthening Identity, Access, and Network Security

An enterprise has a multi-account AWS Organization. An application in VPC-Prod under Account A uses a Route 53 Private Hosted Zone (PHZ) named internal.corp for service discovery. During a security and operations review, the Solutions Architect identifies two issues:

1. Administrators operating from VPC-Shared in Account B cannot resolve the DNS records within internal.corp.
2. A containerized reporting service running on Amazon ECS tasks in Account B must retrieve data from an S3 bucket in Account A. The S3 bucket is currently encrypted using an AWS KMS key. Even though the S3 bucket policy allows access to Account B's root principal, the ECS tasks in Account B receive access denied errors when attempting to read the objects.

Which two configuration steps should the Solutions Architect implement to resolve these security and access issues? (Select two.)

  1. Authorize the VPC association for VPC-Shared from Account A using the AWS CLI, and then associate VPC-Shared with the internal.corp Private Hosted Zone from Account B.Cevap
  2. Configure the S3 bucket in Account A to use a Customer Managed Key (CMK) for encryption, and update the CMK's key policy in Account A to grant the ECS task IAM role in Account B the required KMS decrypt permissions.Cevap
  3. C
    Configure the S3 bucket in Account A to use the default AWS-managed KMS key (aws/s3), and modify its key policy to grant the ECS task IAM role in Account B cross-account decrypt permissions.
  4. D
    Apply a Service Control Policy (SCP) to the Organizational Unit containing Account B that explicitly allows the 'route53:AssociateVPCWithHostedZone' action for the resources in Account A.
  5. E
    Deploy an outbound Route 53 Resolver endpoint in VPC-Shared and configure a resolver rule pointing to a Direct Connect Gateway to enable transitive DNS routing to the Private Hosted Zone.

Cevap

To resolve the DNS and cross-account access issues, the Solutions Architect must authorize the VPC association for VPC-Shared from Account A and associate it from Account B, and configure the S3 bucket to use a Customer Managed Key (CMK) with a key policy that grants decrypt permissions to the ECS task IAM role in Account B.
The correct options are to authorize the VPC association for VPC-Shared from Account A and then associate it from Account B, and to use a Customer Managed Key with a policy that allows the ECS task IAM role in Account B decrypt permissions. Authorizing and associating the PHZ directly enables DNS resolution across the accounts. Using a Customer Managed Key allows the key policy to be customized, which is required because AWS-managed keys cannot be shared across accounts.

Adım Adım Çözüm

1
Authorize the VPC association from the account owning the Private Hosted Zone (Account A) to the VPC in the consumer account (Account B).
VPC-Shared becomes authorized to associate with the internal.corp Private Hosted Zone.
Route 53 Private Hosted Zones cannot be directly associated with VPCs in other accounts without explicit cross-account authorization.
2
Associate VPC-Shared with the Private Hosted Zone from Account B.
Administrators in VPC-Shared can successfully resolve internal.corp DNS records.
This establishes the logical association, allowing DNS queries in VPC-Shared to resolve using the records in the PHZ.
3
Change the S3 bucket encryption from the default AWS-managed KMS key to a Customer Managed Key (CMK) in Account A.
The bucket is encrypted using a key whose policy can be modified.
AWS-managed KMS keys do not support policy edits, which prevents granting the necessary cross-account KMS permissions to Account B.
4
Update the Customer Managed Key's policy in Account A to grant kms:Decrypt permissions to the ECS task IAM role in Account B.
The ECS task in Account B receives permission to decrypt objects retrieved from the S3 bucket.
Cross-account access to KMS-encrypted S3 objects requires permissions in both the S3 bucket policy (or IAM policy) and the KMS key policy.

Anahtar Kavram

Cross-account resource access using Customer Managed Keys and cross-account Route 53 Private Hosted Zone association.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security