Examkin

Soru

Zorluk: KolaySecurity and Compliance Control Design

A solutions architect is designing an integration where an application running on Amazon EC2 instances in Account A must read encrypted objects from an Amazon S3 bucket in Account B. The objects are encrypted using Server-Side Encryption with AWS KMS (SSE-KMS). Which key configuration will successfully allow the application in Account A to decrypt the objects?

  1. Use a Customer Managed Key in Account B, and configure its key policy to grant the IAM role in Account A decrypt permissions.Cevap
  2. B
    Use the AWS-managed key for Amazon S3 (aws/s3) in Account B, and configure the S3 bucket policy in Account B to grant decrypt permissions to Account A.
  3. C
    Use the AWS-managed key for Amazon S3 (aws/s3) in Account B, and apply a Service Control Policy (SCP) at the Organization root to grant cross-account access.
  4. D
    Use a Customer Managed Key in Account B, and configure only the S3 bucket policy in Account B to grant access to Account A without updating the KMS key policy.

Cevap

Use a Customer Managed Key in Account B, and configure its key policy to grant the IAM role in Account A decrypt permissions.
Using a Customer Managed Key (CMK) in Account B allows you to modify its key policy. In a cross-account scenario, the key policy of the CMK in the owning account (Account B) must explicitly grant decrypt permissions to the principal (IAM role) in the reading account (Account A). The role in Account A also needs the corresponding IAM permissions to call the KMS Decrypt action.

Adım Adım Çözüm

1
Select a Customer Managed Key (CMK) rather than an AWS-managed key, as AWS-managed keys cannot be shared across accounts.
You have a key that supports custom key policies for cross-account access.
AWS-managed keys (aws/s3) do not allow policy modifications.
2
Modify the key policy of the CMK in Account B to trust the principal (IAM role) in Account A for the kms:Decrypt action.
Account A is delegated the authority to use the key.
Cross-account access to KMS requires explicit permission delegation in the key policy.
3
Configure the IAM role in Account A with a policy that allows kms:Decrypt on the CMK in Account B.
The application in Account A has both local and resource-level permissions to decrypt.
Both sides of the cross-account boundary must allow the operation.

Anahtar Kavram

Cross-account KMS key sharing requires a Customer Managed Key with a key policy that delegates access to the external account, along with matching local IAM permissions in the external account.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru