A media company stores user-generated video assets in an Amazon S3 bucket located in a central archive AWS account. Currently, these assets are encrypted using Amazon S3 managed keys (SSE-S3). To meet new regulatory compliance requirements, the security team mandates that all assets must be encrypted using customer-managed keys (CMKs) with automatic rotation. Furthermore, an encoding application running in a separate production AWS account must be able to read and write these encrypted assets directly. Which of the following actions should a Solutions Architect perform to implement this secure configuration? (Select TWO.)
- Create a symmetric customer managed KMS key in the archive account. Modify the key policy to grant the encoding application's IAM role in the production account permissions to perform kms:Decrypt and kms:GenerateDataKey operations, and enable automatic key rotation.Cevap
- Configure the S3 bucket in the archive account to use default encryption with the newly created customer managed KMS key. Update the bucket policy to grant the encoding application's IAM role in the production account permissions for s3:PutObject and s3:GetObject.Cevap
- CConfigure the S3 bucket in the archive account to use the default AWS-managed KMS key for S3 (aws/s3). Modify the key policy in the archive account to allow cross-account access from the production account's IAM role.
- DCreate a Service Control Policy (SCP) at the Organizational Unit (OU) level containing the production account to grant the kms:Decrypt and kms:GenerateDataKey permissions, removing the need for local IAM policy updates.
- EConfigure the S3 bucket policy in the archive account to allow cross-account access, and rely on default S3 bucket encryption behaviors to manage KMS key permissions automatically for the cross-account users.
Cevap
Create a symmetric customer managed KMS key in the archive account with cross-account IAM role permissions and automatic key rotation enabled, and configure the archive account's S3 default encryption to use that key while granting s3:PutObject and s3:GetObject permissions in the bucket policy.
To set up secure cross-account S3 access with KMS encryption, a Customer Managed Key (CMK) must be created in the bucket's account (the archive account) because AWS-managed keys cannot be used cross-account. The CMK's key policy must explicitly allow the cross-account IAM role to use the key for decryption and data key generation. Additionally, the S3 bucket's default encryption must be configured to use this CMK, and the S3 bucket policy must allow the production application's IAM role to read and write objects.
Adım Adım Çözüm
Anahtar Kavram
Cross-account KMS key access and default S3 encryption behavior using customer managed keys.