Examkin

Soru

Zorluk: Çok zorStrengthening Identity, Access, and Network Security

A financial services firm runs a legacy application on Amazon EC2 instances in VPC-A under Account 1. The application must retrieve daily audit logs from an Amazon S3 bucket in VPC-B under Account 2, which is currently encrypted using the default AWS-managed S3 key (aws/s3). Currently, this access uses long-lived IAM user access keys, and traffic goes over the public internet. Additionally, the application must resolve private DNS endpoints hosted in a Route 53 Private Hosted Zone (PHZ) in Account 2. The solutions architect needs to remediate these issues by eliminating long-lived credentials, routing all S3 traffic over the AWS internal network, enabling cross-account private DNS resolution, and ensuring that all S3 data is securely accessed with custom encryption keys. Which two of the following actions should the solutions architect perform to meet these requirements?

  1. Create a VPC association authorization from Account 2 to authorize VPC-A in Account 1 to associate with the Route 53 Private Hosted Zone, and then associate VPC-A with the Private Hosted Zone from Account 1.Cevap
  2. Re-encrypt the S3 bucket using a Customer Managed Key (CMK) in Account 2. Configure the CMK's key policy and the S3 bucket policy to grant read access to the EC2 instance profile role in Account 1, and configure a Gateway VPC Endpoint for S3 in VPC-A.Cevap
  3. C
    Keep the S3 bucket encrypted with the AWS-managed KMS key (aws/s3) and configure a cross-account IAM role in Account 2 that trusts the EC2 instance profile in Account 1, enabling the application to access S3 by assuming this role.
  4. D
    Share the Route 53 Private Hosted Zone from Account 2 to Account 1 using AWS Resource Access Manager (RAM), and then update the route tables of VPC-A to point to the shared private hosted zone.
  5. E
    Apply a Service Control Policy (SCP) to the Organizational Unit (OU) containing Account 1 that allows 's3:GetObject' and 'kms:Decrypt' actions on the S3 bucket and key in Account 2 to grant the instances access.

Cevap

The solutions architect should associate the Private Hosted Zone with VPC-A using the VPC association authorization workflow, and re-encrypt the S3 bucket using a Customer Managed Key (CMK) while granting permissions to the EC2 instances' role and configuring a Gateway VPC Endpoint.
To resolve private hosted zones across accounts, a VPC association authorization must be created in the owner account and then accepted/executed in the target VPC's account. For secure cross-account S3 access, a Customer Managed Key (CMK) is required because AWS-managed key policies cannot be modified to grant permissions to external accounts. Configuring a Gateway VPC Endpoint for S3 in the client VPC ensures all traffic remains within the AWS global network, and assigning an EC2 instance profile role replaces static, long-lived credentials with secure, temporary credentials.

Adım Adım Çözüm

1
Submit a VPC association authorization from Account 2 for VPC-A, then associate VPC-A with the Route 53 Private Hosted Zone in Account 1.
VPC-A can resolve the private DNS endpoints hosted in Account 2.
Route 53 Private Hosted Zones cannot be shared via AWS Resource Access Manager and must be associated across accounts using the authorization workflow.
2
Re-encrypt the S3 bucket in Account 2 using a Customer Managed Key (CMK) instead of the default AWS-managed key.
A key policy is created that can be edited to support cross-account access.
AWS-managed key policies cannot be modified, which makes them unusable for cross-account S3 access.
3
Configure the KMS CMK key policy and the S3 bucket policy to allow access to the EC2 instance profile role from Account 1.
The application instances can access and decrypt S3 objects without long-lived credentials.
This establishes access control using temporary credentials provided by the EC2 instance profile.
4
Configure a Gateway VPC Endpoint for S3 in the route tables of VPC-A.
Traffic to S3 from VPC-A is routed privately via the AWS network.
This satisfies the requirement to prevent S3 data transit over the public internet.

Anahtar Kavram

Cross-account secure resource access and private DNS resolution in multi-account AWS environments.
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security