Examkin

Soru

Zorluk: OrtaSecurity and Compliance Control Design

A digital publishing firm, ChronicleGroup, is designing a new solution where an application running on Amazon ECS in a Production Account (Account A) must read editorial archives stored in an Amazon S3 bucket within a shared Archive Account (Account B). The objects in the S3 bucket are encrypted at rest. The application uses an IAM task execution role in Account A to access the resources. Which combination of configuration steps will allow the application in Account A to decrypt and retrieve the archives from the S3 bucket in Account B?

  1. Use a Customer Managed Key (CMK) in Account B for S3 bucket encryption. Configure the CMK key policy in Account B to allow kms:Decrypt for Account A's IAM role. Configure the S3 bucket policy in Account B to grant read access to Account A's IAM role, and attach an IAM policy to Account A's role allowing S3 read and KMS decrypt permissions.Cevap
  2. B
    Use the AWS-managed KMS key (aws/s3) in Account B for S3 bucket encryption. Modify the S3 bucket policy in Account B to allow read access for Account A's IAM role, and attach an IAM policy to the role in Account A allowing s3:GetObject and kms:Decrypt actions.
  3. C
    Use a Customer Managed Key (CMK) in Account B for S3 bucket encryption. Attach a Service Control Policy (SCP) to the Organization Root that allows the IAM role in Account A to perform s3:GetObject and kms:Decrypt on Account B's resources, which grants permission to the role without modifying local IAM or KMS policies.
  4. D
    Use a Customer Managed Key (CMK) in Account B for S3 bucket encryption. Configure the S3 bucket policy and the CMK key policy in Account B to allow read and decrypt access to Account A's IAM role. No IAM policy configuration is required in Account A because the resource-based policies in Account B explicitly delegate access.

Cevap

Use a Customer Managed Key (CMK) in Account B for S3 bucket encryption, grant key decrypt permissions to Account A's IAM role in Account B's key policy, configure the S3 bucket policy in Account B to trust the role, and configure the IAM policy in Account A to permit accessing both resources.
The correct option outlines the necessary three-way handshake for cross-account S3 and KMS access: a Customer Managed Key (CMK) policy in the destination account, a bucket policy in the destination account, and an identity-based IAM policy in the source account.

Adım Adım Çözüm

1
Select the correct key type for cross-account S3 encryption.
Identify that a Customer Managed Key (CMK) is required because AWS-managed keys (aws/s3) do not support cross-account resource sharing.
AWS-managed key policies cannot be altered to include external account principles.
2
Configure the resource policies in the destination account (Account B).
Update the S3 bucket policy and the Customer Managed Key policy to trust Account A's IAM task execution role.
Resource-based policies must allow external accounts or roles to access them.
3
Configure the identity policy in the source account (Account A).
Attach an IAM policy to Account A's IAM role allowing s3:GetObject and kms:Decrypt on Account B's bucket and CMK.
Cross-account access requires explicit permission in both the resource policies and the user/role identity policies.

Anahtar Kavram

Cross-account access to encrypted S3 resources requires a Customer Managed Key (CMK) with configurations in the IAM identity policy, S3 bucket policy, and KMS key policy.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru