CareSync Technologies is deploying a new telemedicine application. The application's core processing engine runs on Amazon ECS in the Application account (Account ). The engine must write and read patient record files in an Amazon S3 bucket located in the Data account (Account ). To comply with regulatory requirements, all stored data must be encrypted at rest. The security team has established the following constraints:
- All S3 objects must be encrypted using a Customer Managed Key (CMK) stored in Account .
- The ECS tasks in Account must be able to upload and download objects to and from the S3 bucket.
- Access control lists (ACLs) must be completely disabled on the bucket, and the Data account must automatically own all uploaded objects.
Which combination of configurations will meet these requirements? (Select TWO.)
- Configure the KMS key policy in Account to grant the ECS task role in Account permissions for the kms:Decrypt and kms:GenerateDataKey actions.Cevap
- Configure the S3 bucket policy in Account to allow the ECS task role in Account to perform s3:PutObject and s3:GetObject actions, and set the S3 Object Ownership setting on the bucket to Bucket owner enforced.Cevap
- CEnable default S3 encryption using the AWS-managed S3 key (aws/s3) in Account , and update the key policy to delegate access to the ECS task role in Account .
- DConfigure the S3 bucket policy in Account to allow the ECS task role in Account to perform s3:PutObject actions, set the S3 Object Ownership to Object writer, and require the ECS tasks to specify the bucket-owner-full-control ACL when uploading objects.
- EAttach a Service Control Policy (SCP) at the organization root level that grants the ECS task role in Account permission to write to the S3 bucket and access the KMS key in Account .