Examkin

Soru

Zorluk: OrtaSecurity and Compliance Control Design

An enterprise healthcare provider, ApexHealth, is setting up a centralized compliance auditing platform across its multi-account AWS Organization. A third-party SaaS security application running in an external AWS account (Account Vendor) must periodically scan resources and read access logs across the provider's production accounts. To meet strict regulatory requirements: 1. The SaaS application must assume a read-only role in each member account. 2. The trust relationship must be secured using a unique external ID provided by the vendor. 3. The logs collected by the SaaS application must be written directly to a centralized S3 bucket in a dedicated Compliance Account (Account C). 4. All logs in Account C must be encrypted at rest with a key that allows the security team to revoke access immediately if a compromise is suspected. Which configuration must the Solutions Architect implement to meet these requirements?

  1. In each member account, configure an IAM role with a trust policy that specifies the vendor's AWS account principal, includes the `sts:AssumeRole` action, and enforces a condition for the external ID. In the Compliance Account, use a Customer Managed Key (CMK) for S3 bucket encryption, and update the KMS key policy and the S3 bucket policy to allow the roles in the member accounts to perform the write operations.Cevap
  2. B
    In each member account, configure an IAM role with a trust policy that specifies the vendor's SAML 2.0 identity provider as the principal, and specify the `sts:AssumeRoleWithSAML` action. In the Compliance Account, use a Customer Managed Key (CMK) for S3 bucket encryption, and update the KMS key policy and S3 bucket policy to allow the assumed roles to write logs.
  3. C
    In the Organization's management account, create a Service Control Policy (SCP) that grants the vendor's AWS account principal permission to assume the target roles across all member accounts and write to the Compliance Account's S3 bucket, eliminating the need to configure individual IAM role trust policies or resource policies.
  4. D
    In each member account, configure an IAM role with a trust policy that specifies the vendor's AWS account principal, includes the `sts:AssumeRole` action, and enforces a condition for the external ID. In the Compliance Account, enable S3 default encryption using the AWS-managed KMS key (`aws/s3`), and configure the S3 bucket policy to allow write access from the member accounts.

Cevap

The correct solution requires creating an IAM role in each member account with a trust policy that permits cross-account role assumption using the vendor's AWS account principal and the external ID condition. S3 bucket encryption in the Compliance Account must use a Customer Managed Key, and both the KMS key policy and the S3 bucket policy must be updated to grant permissions to the member account roles.
The correct approach involves configuring cross-account IAM roles with a trust policy using the vendor's AWS account principal and enforcing a condition for the external ID. For cross-account access to encrypted S3 buckets, AWS-managed keys cannot be used since their key policies are immutable and cannot be shared across accounts. Therefore, a Customer Managed Key must be used, and its key policy must explicitly grant access to the external roles, along with a corresponding S3 bucket policy allowing write access.

Adım Adım Çözüm

1
Define cross-account access roles in the member accounts.
IAM roles are created with a trust policy allowing the vendor's AWS account principal to assume the role, secured by a condition requiring the external ID.
This implements secure cross-account delegated access with a unique external ID to prevent the confused deputy problem.
2
Configure encryption for the central log bucket in the Compliance Account using a Customer Managed Key (CMK).
A Customer Managed Key is generated with a key policy allowing access from the member accounts' assumed roles.
AWS-managed KMS keys (such as `aws/s3`) do not support cross-account access because their key policies cannot be modified.
3
Update resource policies in the Compliance Account.
The S3 bucket policy and the KMS key policy in the Compliance Account are updated to allow the specific member account role ARNs to perform write and encrypt operations.
Both the S3 bucket policy and the KMS key policy must explicitly authorize cross-account access for the encryption/decryption and write actions to succeed.

Anahtar Kavram

Cross-account IAM role assumption combined with Customer Managed Key (CMK) resource policies for cross-account S3 bucket access.
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru