Examkin

Soru

Zorluk: Çok zorStrengthening Identity, Access, and Network Security

An enterprise manages a multi-account environment on AWS. Account A hosts an application running on Amazon EC2 instances within a private subnet. This application must write sensitive logs and data to an Amazon S3 bucket located in Account B. The S3 bucket is encrypted using a Customer Managed Key (CMK) stored in Account B. To strengthen identity, access, and network security for this data transfer path, a solutions architect must enforce strict network isolation ensuring that data only traverses AWS private networks, and verify that only authorized IAM roles in Account A can write to the bucket and decrypt the objects. Service Control Policies (SCPs) must be utilized to maintain these guardrails. Which combination of actions will securely achieve this objective? (Select TWO.)

  1. Update the key policy of the Customer Managed Key in Account B to grant the IAM role in Account A permission to perform the kms:Decrypt and kms:GenerateDataKey actions, and attach an IAM policy to the role in Account A allowing these same actions on the key ARN.Cevap
  2. Configure a Gateway VPC endpoint for Amazon S3 in Account A's VPC. Modify the S3 bucket policy in Account B to deny access to all principals unless the request originates from this specific VPC endpoint ID using the aws:sourceVpce condition.Cevap
  3. C
    Update the default AWS-managed KMS key (aws/s3) policy in Account B to add a cross-account grant for Account A's IAM role, and configure the IAM policy in Account A to allow kms:Decrypt on Account B's AWS-managed key.
  4. D
    Deploy a Service Control Policy (SCP) at the Organization root level that explicitly allows s3:PutObject and kms:Decrypt actions on Account B's resources, thus granting permissions to the IAM role in Account A without modifying local policies.
  5. E
    Establish a Transit Gateway route table entry that redirects all traffic directed to the public S3 CIDR blocks through a Transit Gateway peering attachment directly to Account B, without creating any VPC endpoints.

Cevap

The correct options are configuring the S3 VPC endpoint combined with a deny-based bucket policy restricting access to that VPC endpoint, and setting up cross-account permissions on the Customer Managed Key (CMK) in the destination account while granting corresponding IAM permissions in the source account.
The correct solution involves two main aspects: private network routing and cross-account cryptographic access. Enforcing private routing is achieved by deploying a Gateway VPC endpoint and enforcing it via the S3 bucket policy using the 'aws:sourceVpce' condition. Cryptographic access is established by using a Customer Managed Key (CMK) and creating a trust path where the KMS key policy in the destination account explicitly delegates access to the identity in the source account, which is matched by a corresponding IAM permission in the source account.

Adım Adım Çözüm

1
Establish network isolation using VPC endpoints.
A Gateway VPC endpoint is configured in the source VPC to route S3 traffic over the AWS internal network.
This prevents data from traversing the public internet and establishes a private path for S3 access.
2
Apply resource-level network restrictions.
The S3 bucket policy in Account B is updated with a condition that blocks all traffic unless the source VPC endpoint matches the configured VPC endpoint ID.
This ensures that traffic from outside the designated private VPC endpoint is strictly denied, maintaining network isolation.
3
Configure cross-account KMS permissions.
The key policy in Account B is updated to delegate decryption capabilities to Account A, and Account A's IAM role is given permissions to invoke the KMS key.
Because the S3 bucket is encrypted using a Customer Managed Key, cross-account access requires explicit IAM permissions in the source account and key policy permissions in the destination account.

Anahtar Kavram

Strengthening Identity, Access, and Network Security
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security