Examkin

Soru

Zorluk: ZorEnhancing Data Protection and Compliance

A multinational corporation runs its workloads across multiple AWS accounts managed under AWS Organizations. As part of a security audit, a solutions architect is tasked with upgrading the data protection configuration for application access logs. These logs are pushed from member accounts to a centralized Amazon S3 bucket in a dedicated Logging Account. The S3 bucket currently uses default encryption with the AWS-managed KMS key for Amazon S3 (aws/s3). The audit requires that all logs must be encrypted at rest using a key that supports automatic rotation and allows the organization to control key access policies. The member accounts must be able to continue writing logs, and the security analysts in the Logging Account must be able to read and decrypt them. Which of the following represents the most secure and compliant way to implement this requirement?

  1. A
    Retain the AWS-managed key (aws/s3) in the Logging Account. Modify the S3 bucket's resource policy to permit cross-account s3:PutObject requests from the member accounts. Update the key policy of the AWS-managed aws/s3 key in the Logging Account to delegate cross-account access, granting kms:GenerateDataKey permissions to the member accounts' execution roles.
  2. B
    Generate a symmetric customer managed KMS key in the Logging Account. Update the key policy of the customer managed key to allow kms:GenerateDataKey and kms:Decrypt permissions to the Logging Account root user. Modify the centralized S3 bucket's resource policy to grant s3:PutObject and kms:GenerateDataKey permissions to the member accounts, relying on the bucket policy to delegate key access.
  3. Provision a symmetric customer managed KMS key in the Logging Account. Update the key's policy to grant the member accounts' execution roles the permission to perform the kms:GenerateDataKey action, and grant the Logging Account's security analysts permission to perform the kms:Decrypt action. Configure the centralized S3 bucket to use this customer managed KMS key as the default encryption key, and modify the bucket's resource policy to permit cross-account s3:PutObject requests.Cevap
  4. D
    Deploy a symmetric customer managed KMS key in the Logging Account. Configure the centralized S3 bucket to use this customer managed key as the default encryption key. Attach a Service Control Policy (SCP) at the root level of the organization that allows kms:GenerateDataKey and kms:Decrypt actions for all member accounts to grant them direct permission to use the customer managed key in the Logging Account.

Cevap

Provision a symmetric customer managed KMS key in the Logging Account, granting the member accounts' roles kms:GenerateDataKey permissions and the security analysts kms:Decrypt permissions, while configuring the centralized S3 bucket policy to allow cross-account s3:PutObject writes.
The correct solution relies on a symmetric customer managed KMS key in the Logging Account. Since AWS-managed keys (like aws/s3) cannot have their key policies modified to grant permissions to external accounts, a customer managed key is required to support cross-account log delivery. The key policy of the customer managed key must explicitly grant the member accounts' roles permission to generate a data key (kms:GenerateDataKey) to encrypt the log files as they are written, while granting the Logging Account's security analysts decrypt permissions (kms:Decrypt). The bucket policy handles S3 permissions (s3:PutObject), but key permissions must be managed through the KMS key policy.

Adım Adım Çözüm

1
Identify key type constraints for cross-account access.
AWS-managed keys (such as aws/s3) cannot be shared or delegated cross-account because their key policies are immutable. A customer managed KMS key must be used.
Compliance requires a key that supports rotation and key policies that the organization can modify to permit cross-account operations.
2
Configure the KMS key policy in the Logging Account.
The key policy must explicitly allow the member accounts' write roles/services permission for kms:GenerateDataKey, and grant kms:Decrypt permission to the analysts in the Logging Account.
Since member accounts write to the S3 bucket, they must generate a data key to encrypt the payload. The analysts must decrypt it to read the logs.
3
Configure S3 bucket default encryption and resource policy.
Set default S3 bucket encryption to use the customer managed KMS key. Update the S3 bucket policy to permit s3:PutObject from the member accounts' principal ARNs.
This guarantees that all newly uploaded objects are automatically encrypted using the central customer managed key, and grants cross-account S3 write permission.

Anahtar Kavram

Cross-account KMS encryption key sharing constraints and S3 resource policies
Bu soruyu puanla

Konular

Enhancing Data Protection and Compliance