Examkin

Soru

Zorluk: OrtaSecurity and Compliance Control Design

An enterprise logistics company is designing a new compliance tracking application. The application runs on Amazon EC2 instances in an Application Account under a specific IAM role. The application must write transaction logs to a centralized Amazon S3 bucket in a Security Account. The compliance team requires all logs to be encrypted at rest using a Key Management Service (KMS) key managed by the compliance team, with access restricted using the principle of least privilege.

Which two of the following configuration steps are required to implement this secure cross-account logging solution? (Select TWO.)

  1. Create a Customer Managed Key (CMK) in the Security Account, and configure its key policy to allow the Application Account's IAM role to perform kms:GenerateDataKey and kms:Decrypt actions.Cevap
  2. Configure the S3 bucket policy in the Security Account to grant s3:PutObject permissions directly to the specific IAM role from the Application Account.Cevap
  3. C
    Enable default S3 bucket encryption in the Security Account using the AWS-managed S3 key (aws/s3), and configure the IAM policy in the Application Account to grant the application role access to this key.
  4. D
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) of the Application Account that explicitly grants the s3:PutObject action on the central S3 bucket.
  5. E
    Configure the S3 bucket policy in the Security Account to allow the S3 service principal (s3.amazonaws.com) to write logs, without specifying the Application Account's IAM role or account ID as a principal.

Cevap

To configure secure cross-account logging, a Customer Managed Key must be created in the Security Account with a key policy allowing the application's IAM role to perform cryptographic operations, and the S3 bucket policy in the Security Account must explicitly grant write permissions to the application's IAM role.
The correct solution involves creating a Customer Managed Key (CMK) in the Security Account and configuring its key policy to delegate access to the application's IAM role, alongside configuring the central S3 bucket policy to grant write permissions to the application's IAM role. This establishes trust and permissions at both the identity level (Application Account) and the resource level (Security Account), while enabling cross-account encryption using a key that the compliance team can manage.

Adım Adım Çözüm

1
Identify the KMS requirements for cross-account encryption.
Determine that an AWS-managed key cannot be shared across accounts, requiring a Customer Managed Key (CMK) in the Security Account.
AWS-managed keys have immutable key policies that do not support cross-account access.
2
Configure the Customer Managed Key policy in the Security Account.
Add a statement to the key policy that permits the Application Account's IAM role to perform kms:GenerateDataKey and kms:Decrypt.
This allows the application to encrypt the logs before storing them in S3 using the centralized key.
3
Identify the S3 permissions required for cross-account writes.
Determine that both the IAM policy in the Application Account and the S3 bucket policy in the Security Account must allow the write operation.
Cross-account S3 access requires explicit authorization on both the source identity and the destination resource.
4
Configure the S3 bucket policy in the Security Account.
Add a policy statement granting s3:PutObject to the specific ARN of the Application Account's IAM role.
This satisfies the destination-side permission and restricts access to only the authorized application role.

Anahtar Kavram

Cross-account security controls require explicit resource policies (S3 bucket policy and KMS key policy) in the destination account that trust the specific IAM principal in the source account, combined with a Customer Managed Key for shared encryption capability.
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru