Examkin

Soru

Zorluk: OrtaSecurity and Compliance Control Design

A SaaS company, 'MetricsFlow', is designing a multi-tenant analytics dashboard. The application running on Amazon EC2 instances in the Production Account (Account A) must read historical reporting logs stored in an Amazon S3 bucket within the Analytics Account (Account B). The S3 bucket is encrypted using an AWS KMS Customer Managed Key (CMK) created in Account B. The security team requires that all cross-account data access adheres to the principle of least privilege.

Which combination of actions must the solutions architect perform in the Analytics Account (Account B) to enable this access? (Select TWO.)

  1. Update the S3 bucket policy in Account B to grant the s3:GetObject permission to the ARN of the IAM role associated with the EC2 instances in Account A.Cevap
  2. Update the KMS key policy of the CMK in Account B to grant the kms:Decrypt permission to the ARN of the IAM role associated with the EC2 instances in Account A.Cevap
  3. C
    Modify the S3 encryption configuration in Account B to use the default AWS-managed KMS key (aws/s3) and configure cross-account access using S3 Access Points.
  4. D
    Attach a Service Control Policy (SCP) to the organization root in Account B that explicitly allows the IAM role in Account A to assume key decryption permissions.
  5. E
    Configure a SAML 2.0 federated trust relationship directly within the S3 bucket policy to authorize and trust the EC2 instance profile from Account A.

Cevap

To securely enable cross-account access to encrypted S3 objects, the resource policies in the destination account must trust the IAM identity in the source account. This is accomplished by updating the S3 bucket policy to allow the read action, and updating the Customer Managed Key (CMK) policy to allow the decryption action for the source account's IAM role.
For cross-account access to S3 objects encrypted with a Customer Managed Key (CMK), the resource owner must update both the S3 bucket policy and the KMS key policy in the destination account to explicitly grant access to the IAM role in the source account. The bucket policy must grant read permissions, and the key policy must grant decrypt permissions.

Adım Adım Çözüm

1
Identify the S3 permissions required for cross-account read access.
Determine that the S3 bucket policy in Account B must explicitly permit the IAM role in Account A to read objects.
By default, cross-account access requires explicit permission in the resource-based policy of the resource being accessed.
2
Identify the KMS permissions required for decryption.
Determine that the Customer Managed Key (CMK) policy in Account B must explicitly permit the IAM role in Account A to perform decryption.
When objects are encrypted with a Customer Managed Key, the reader must have permissions on both the S3 bucket and the key used for encryption.

Anahtar Kavram

Cross-account access to encrypted S3 resources requires resource-based policy delegation on both the S3 bucket and the KMS Customer Managed Key.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Security and Compliance Control Design

Bu konudan daha fazla soru