Examkin

Soru

Zorluk: OrtaSecurity and Compliance Control Design

An enterprise is designing a secure cross-account logging solution. Application servers running on Amazon EC2 instances in a Production Account (Account A) need to write sensitive log files to an Amazon S3 bucket in a centralized Security Account (Account B). The log files must be encrypted at rest using an AWS KMS key located in Account B, and the security team requires the use of a Customer Managed Key (CMK) to allow key policy modification and annual rotation. Which combination of configuration steps is required to implement this secure, least-privilege architecture? (Select TWO.)

  1. In the Security Account (Account B), configure the S3 bucket policy to allow the application server IAM role from the Production Account (Account A) to perform the s3:PutObject action, and configure the KMS key policy to allow the same role to perform the kms:GenerateDataKey action.Cevap
  2. In the Production Account (Account A), attach an IAM policy to the EC2 instance role that grants the s3:PutObject permission on the destination S3 bucket and the kms:GenerateDataKey permission on the KMS key in the Security Account (Account B).Cevap
  3. C
    In the Security Account (Account B), configure the S3 bucket to use the default AWS managed key (aws/s3) for encryption, and grant cross-account access to the Production Account (Account A) role via the S3 bucket policy.
  4. D
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) of the Production Account (Account A) that explicitly grants s3:PutObject and kms:GenerateDataKey access, allowing the EC2 instances to write to the bucket without local IAM policies.
  5. E
    In the Security Account (Account B), configure the S3 bucket policy to allow the s3:PutObject action but omit the principal element, relying on the Production Account (Account A) local IAM policies to establish trust.

Cevap

Configure the S3 bucket policy and KMS key policy in the Security Account to grant access to the application server's IAM role, and attach a local IAM policy in the Production Account that allows the application server role to perform the required actions on the S3 bucket and KMS key.
Establishing secure cross-account access for S3 buckets encrypted with a KMS CMK requires explicit permissions on both the trusting and trusted sides. The resource owner (the Security Account) must configure the S3 bucket policy and the KMS key policy to permit the IAM role from the Production Account. Simultaneously, the trusted side (the Production Account) must configure the IAM policy attached to the application role to grant access to the external S3 bucket and the external KMS key.

Adım Adım Çözüm

1
Configure destination resource policies in the Security Account
The S3 bucket policy allows s3:PutObject for the Production Account's IAM role, and the KMS key policy allows kms:GenerateDataKey for the same role.
Cross-account access requires the resource owner to explicitly delegate access to the external trust principal.
2
Configure the source IAM role permissions in the Production Account
The application server's IAM role is updated with an identity-based policy granting s3:PutObject and kms:GenerateDataKey on the resources in the Security Account.
Even when the resource policy allows access, the IAM principal must have explicit identity-based permissions to perform cross-account actions.

Anahtar Kavram

Cross-account resource sharing and KMS delegation
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru