An enterprise is designing a centralized data processing platform across multiple AWS acco… — AWS Certified Solutions Architect - Professional

An enterprise is designing a centralized data processing platform across multiple AWS accounts. Application servers running in Account A ( $111122223333$ ) must write telemetry data directly to an Amazon S3 bucket located in the central Analytics Account ( $444455556666$ ).

The security policy mandates the following requirements:
1. All data written to the S3 bucket must be encrypted at rest using an AWS KMS Customer Managed Key (CMK) created and managed in a dedicated Security Account ( $777788889999$ ).
2. Separation of duties must be enforced, ensuring that Account A has no administrative control over the KMS key, and Account A's IAM administrators cannot modify the key policy.
3. Access must follow the principle of least privilege.

Which of the following combinations of actions should the Solutions Architect take to configure the permissions for this architecture? (Select TWO.)

In the Security Account ( $777788889999$ ), update the KMS Customer Managed Key policy to grant the IAM role in Account A ( $111122223333$ ) permissions to perform the kms:GenerateDataKey and kms:Decrypt actions.Cevap
In the Analytics Account ( $444455556666$ ), update the S3 bucket policy to grant the IAM role in Account A ( $111122223333$ ) permissions to perform the s3:PutObject action.Cevap
C
In the Security Account ( $777788889999$ ), configure the AWS managed KMS key for Amazon S3 (aws/s3) key policy to grant cross-account permissions to the IAM role in Account A ( $111122223333$ ).
D
In the Analytics Account ( $444455556666$ ), modify the S3 bucket policy to grant the IAM role in Account A ( $111122223333$ ) permissions to perform the kms:GenerateDataKey and kms:Decrypt actions on the KMS key in the Security Account ( $777788889999$ ).
E
Attach a Service Control Policy (SCP) at the Organization root that grants Account A ( $111122223333$ ) permissions to perform the kms:GenerateDataKey action on the KMS key in the Security Account ( $777788889999$ ).

Cevap

The correct configuration requires updating the KMS Customer Managed Key policy in the Security Account to grant the Account A IAM role access to generate data keys and decrypt objects, and updating the S3 bucket policy in the Analytics Account to allow the Account A IAM role to write objects to the bucket.

The correct configuration combines updating the KMS Customer Managed Key policy in the Security Account to grant key access to the IAM role in Account A, and updating the S3 bucket policy in the Analytics Account to permit write access to the same role. This successfully establishes the trust path required for cross-account S3 uploads under KMS encryption.

Adım Adım Çözüm

Configure cross-account S3 permissions

The S3 bucket policy in the Analytics Account is updated to permit s3:PutObject for the IAM role in Account A.

Because the S3 bucket is owned by a different account (Analytics Account), the bucket policy must explicitly grant write permissions to the external principal.

Configure cross-account KMS permissions

The KMS Customer Managed Key policy in the Security Account is updated to allow the IAM role in Account A to call kms:GenerateDataKey and kms:Decrypt.

Since the KMS key resides in the Security Account, the key policy must delegate access to the external role so that it can encrypt and decrypt objects written to S3.

Configure local IAM permissions in Account A

The application IAM role in Account A is updated with policies allowing s3:PutObject on the target bucket and KMS actions on the key ARN.

The principal in Account A requires explicit local IAM permissions for both the S3 bucket and the KMS key to initiate the write operation.

Anahtar Kavram

Cross-account security controls combining S3 bucket policies and KMS key policies with Customer Managed Keys.

Tahmini Süre:3m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru