Examkin

Soru

Zorluk: OrtaEnhancing Data Protection and Compliance

A SaaS provider has an existing multi-account AWS environment managed under AWS Organizations. Member accounts upload sensitive compliance logs to a centralized Amazon S3 bucket located in a dedicated Security account. Currently, the S3 bucket is configured with default encryption using the AWS-managed KMS key (`aws/s3`). To meet new regulatory standards, the company must enhance data protection by using a customer managed key with annual rotation enabled, enforcing this encryption mechanism across all uploads, and ensuring that access to the key is properly delegated. Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Create a customer managed KMS key in the Security account, configure its key policy to allow the member accounts' IAM roles `kms:GenerateDataKey*` and `kms:Decrypt` permissions, and enable annual automatic key rotation.Cevap
  2. Apply a Service Control Policy (SCP) to the member accounts' Organizational Units (OUs) that denies `s3:PutObject` requests unless they use `aws:kms` encryption and specify the ARN of the customer managed KMS key.Cevap
  3. C
    Modify the key policy of the default AWS-managed KMS key (`aws/s3`) in the Security account to allow cross-account `kms:GenerateDataKey` and `kms:Decrypt` permissions for the member accounts.
  4. D
    Create a Service Control Policy (SCP) that grants the member accounts the necessary permissions to use the customer managed KMS key, attaching it to the OUs so that local member account IAM roles do not require explicit IAM permissions.
  5. E
    Configure the S3 bucket policy in the Security account to allow `s3:PutObject` from the member accounts, which will automatically delegate cross-account KMS permissions without needing to modify the KMS key policy.

Cevap

The correct actions are: (1) Creating a customer managed KMS key in the Security account, configuring its key policy to trust the member accounts, and enabling annual automatic key rotation. (2) Applying a Service Control Policy (SCP) that denies `s3:PutObject` requests unless they specify the customer managed KMS key.
To satisfy the regulatory requirements, a customer managed KMS key must be created in the Security account because AWS-managed keys cannot be shared across accounts. Enabling key rotation ensures annual key updates. To enforce this, a Service Control Policy (SCP) should be applied to the member accounts' OUs to deny any `s3:PutObject` requests that do not use the specified KMS key, establishing a strong compliance guardrail.

Adım Adım Çözüm

1
Identify the type of KMS key that supports cross-account access and automatic rotation.
AWS-managed keys (`aws/s3`) cannot be shared across accounts. A customer managed KMS key must be created in the Security account.
Customer managed KMS keys allow modifying the key policy to delegate cross-account access and support automatic rotation.
2
Configure permissions for member accounts to write encrypted objects.
The customer managed KMS key's key policy in the Security account must explicitly delegate access to the member accounts.
Cross-account access to KMS keys requires explicit delegation in the key policy as S3 bucket policies do not automatically delegate KMS permissions.
3
Enforce the compliance encryption standard across the organization.
Apply a Service Control Policy (SCP) to the member OUs that denies `s3:PutObject` unless the specific customer managed KMS key is used.
SCPs act as guardrails, allowing centralized enforcement of encryption standards across all member accounts without granting direct access.

Anahtar Kavram

Cross-account access delegation with KMS, S3 bucket policies, and SCP guardrails in AWS Organizations.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Enhancing Data Protection and Compliance