Examkin

Soru

Zorluk: OrtaStrengthening Identity, Access, and Network Security

An enterprise is reviewing the security of a multi-account AWS environment. In Account A, an application running on Amazon EC2 instances needs to read encrypted files from an Amazon S3 bucket located in Account B. The S3 bucket is currently encrypted using the default AWS-managed key (`aws/s3`). To comply with the principle of least privilege and strengthen cross-account access controls, a solutions architect must configure the access path. Which of the following configurations will successfully and securely enable the EC2 instances in Account A to read the encrypted S3 objects in Account B?

  1. Configure the S3 bucket in Account B to use a Customer Managed Key (CMK) for encryption. Update the CMK key policy in Account B to allow the IAM role of the EC2 instances in Account A to perform decryption. Grant the S3 bucket policy in Account B and the IAM policy in Account A permissions to read the S3 objects.Cevap
  2. B
    Retain the default AWS-managed key (`aws/s3`) for S3 bucket encryption. Modify the key policy of `aws/s3` in Account B to allow the IAM role of the EC2 instances in Account A to perform decryption, and configure the S3 bucket policy in Account B to allow cross-account access.
  3. C
    Attach a Service Control Policy (SCP) at the AWS Organizations root that explicitly grants decryption and read access to the S3 bucket in Account B for the IAM role in Account A, and rely on the SCP to automatically delegate permissions cross-account.
  4. D
    Create a Route 53 Private Hosted Zone for the S3 bucket endpoint in Account B and associate it with the VPC in Account A, relying on the private DNS resolution to bypass default KMS cross-account decryption restrictions.

Cevap

Configure the S3 bucket in Account B to use a Customer Managed Key (CMK) for encryption. Update the CMK key policy in Account B to allow the IAM role of the EC2 instances in Account A to perform decryption. Grant the S3 bucket policy in Account B and the IAM policy in Account A permissions to read the S3 objects.
The correct configuration uses a Customer Managed Key (CMK) for the S3 bucket encryption. Because default AWS-managed keys (like `aws/s3`) do not support policy modification, they cannot be configured to allow decryption requests from external AWS accounts. Using a Customer Managed Key allows the owner of the key (Account B) to edit the key policy and grant `kms:Decrypt` access to the IAM role in Account A. Combined with the appropriate S3 bucket policy in Account B and the IAM user/role policy in Account A, this securely authorizes the cross-account read request.

Adım Adım Çözüm

1
Transition S3 encryption from the AWS-managed key (`aws/s3`) to a Customer Managed Key (CMK) in Account B.
A Customer Managed Key is created and configured as the encryption key for the target S3 bucket.
AWS-managed KMS keys do not permit modifications to their key policies, making them unusable for cross-account decryption operations.
2
Update the CMK key policy in Account B to trust the IAM role in Account A.
The key policy explicitly grants the `kms:Decrypt` permission to the ARN of the IAM role assigned to the EC2 instances in Account A.
For cross-account KMS access, the resource owner (Account B) must explicitly authorize the external identity in the key policy.
3
Update the S3 bucket policy in Account B and the IAM policy in Account A to allow read permissions.
The S3 bucket policy in Account B allows `s3:GetObject` for the Account A IAM role, and the Account A IAM policy allows `s3:GetObject` and `kms:Decrypt`.
Cross-account S3 access requires explicit authorization in both the source IAM policy (trusting/allowing outbound) and the target bucket policy (allowing inbound).

Anahtar Kavram

Cross-account access to KMS-encrypted S3 objects requires a Customer Managed Key because AWS-managed keys cannot be shared cross-account.
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security