A company is designing a multi-account architecture using AWS Organizations. A central Network account manages a shared VPC and wants to share specific subnets with multiple Application accounts using AWS Resource Access Manager (RAM). The security team requires all Amazon Elastic Block Store (EBS) volumes created by the Application accounts inside these shared subnets to be encrypted using a central key managed in a dedicated Security account. Which strategy should the Solutions Architect implement to meet these requirements?
- AConfigure AWS RAM to share the subnets with the AWS Organization. In the Security account, use the default AWS-managed key for EBS (aws/ebs) and update its key policy to allow cross-account access for the Application accounts. In the Application accounts, configure EBS encryption to reference the Security account's aws/ebs key ARN.
- BEnable resource sharing with external entities in AWS RAM, and share the subnets with the Application account IDs individually without enabling AWS Organizations integration. In the Security account, create a Customer Managed Key (CMK) and configure its key policy to grant the Application accounts access to the key.
- Configure AWS RAM to share the subnets with the AWS Organization. In the Security account, create a Customer Managed Key (CMK), and update its key policy to grant the Application accounts' IAM roles and EC2 service-linked roles permission to use the key. In the Application accounts, configure EBS encryption to use this shared CMK.Cevap
- DConfigure AWS RAM to share the subnets with the AWS Organization. Attach a Service Control Policy (SCP) at the organization's root level that grants the Application accounts access to the default AWS-managed key (aws/ebs) located in the Security account.
Cevap
Configure AWS Resource Access Manager (RAM) to share subnets with the organization, create a Customer Managed Key (CMK) in the Security account, update the CMK key policy to allow the Application accounts' IAM roles and service-linked roles access, and configure EBS encryption in the Application accounts to use the shared CMK.
The correct strategy is to share the subnets within the AWS Organization using AWS RAM and use a Customer Managed Key (CMK) in the Security account. Since VPC subnets can only be shared inside an AWS Organization and AWS-managed keys cannot be shared cross-account, a CMK must be used with a key policy that allows the application accounts' IAM roles and EC2 service-linked roles to use it.
Adım Adım Çözüm
Anahtar Kavram
Cross-account resource sharing with AWS RAM and Customer Managed Keys (CMKs)