A financial technology startup has a decentralized application environment where multiple development teams manage separate AWS accounts. The startup stores transaction ledger exports in an Amazon S3 bucket located in a centralized auditing account. To meet strict regulatory standards, the compliance team requires that all ledger exports be encrypted at rest using a customer-managed KMS key that undergoes annual rotation. The keys must be controlled centrally, but write permissions must be delegated to the application roles in the member accounts, while preventing any account from disabling the key or modifying the key policy.
Which combination of actions will meet these compliance requirements? (Select TWO.)
- Create a customer-managed KMS key in the centralized auditing account, enable automatic key rotation, and configure the key policy to delegate root-level access to the auditing account while explicitly granting kms:GenerateDataKey permissions to the member account IAM roles.Cevap
- Apply a Service Control Policy (SCP) at the AWS Organizations root that denies kms:DisableKey, kms:ScheduleKeyDeletion, and kms:PutKeyPolicy actions across all member accounts, except when performed by the centralized security administration role.Cevap
- CConfigure the S3 bucket to use the AWS-managed KMS key (aws/s3) and update the key policy to authorize cross-account access for the application IAM roles in the member accounts.
- DAttach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the member accounts to explicitly grant kms:GenerateDataKey and kms:Decrypt permissions to the application IAM roles, avoiding direct modification of the KMS key policy.
- EConfigure the S3 bucket policy in the auditing account to allow cross-account s3:PutObject actions from the member accounts, but do not grant the member accounts direct access in the KMS key policy, relying on S3 bucket-level delegation to authorize KMS encryption.
Cevap
Create a customer-managed KMS key in the centralized auditing account with cross-account access granted to member roles and automatic rotation enabled, and apply a Service Control Policy (SCP) at the root level of the organization that prevents unauthorized modification or deletion of the KMS keys.
To encrypt S3 objects cross-account with KMS, you must use a customer-managed key since AWS-managed keys (like aws/s3) cannot have their policies modified to allow cross-account access. The key policy in the auditing account must grant the member account roles permissions like kms:GenerateDataKey. To prevent deletion or alteration of key settings across the organization, an SCP should be used to restrict administrative key operations to the centralized security role.
Adım Adım Çözüm
Anahtar Kavram
Cross-account KMS key sharing with KMS key policy delegation and Organization Service Control Policy (SCP) administrative guardrails.
Tahmini Süre:2m 0s