A company has an existing application that stores sensitive customer documents in an Amazon S3 bucket within a production AWS account. The S3 bucket is currently encrypted using the AWS-managed KMS key (aws/s3). To meet new regulatory compliance requirements, a security audit determines that:
- The encryption key must be rotated automatically on an annual basis, and the security team must have the ability to explicitly edit its key policy.
- A compliance audit team operating from a separate, dedicated audit AWS account must be able to read the encrypted documents directly from the S3 bucket.
Which combination of actions will meet these requirements? (Select TWO.)
- Create a Customer Managed Key (CMK) in the production account, enable automatic key rotation, and configure the key policy to allow the audit account's IAM role to perform the kms:Decrypt action.Cevap
- Modify the S3 bucket policy in the production account to allow the audit account's IAM role to perform the s3:GetObject action, and configure the audit account's IAM role policy to allow s3:GetObject and kms:Decrypt actions on the production S3 and KMS key resources.Cevap
- CConfigure a cross-account IAM policy using the default AWS-managed KMS key (aws/s3) and attach it to the audit account's IAM role to grant decrypt permissions.
- DCreate a Service Control Policy (SCP) at the AWS Organizations root that explicitly allows the audit account to access the production S3 bucket and the aws/s3 key.
- ECreate an S3 Access Point in the production account and grant the audit account's IAM role access to it, without modifying the underlying S3 bucket policy or creating a Customer Managed Key.
Cevap
To meet the compliance and encryption requirements, the company must create a Customer Managed Key (CMK) in the production account, enable automatic key rotation, and configure the key policy to permit the audit account's IAM role to decrypt. Additionally, the production account's S3 bucket policy must grant read access to the audit account's IAM role, and the audit role itself must have IAM permissions to read from the S3 bucket and decrypt using the production account's KMS CMK.
The correct options work together to establish cross-account trust and decryption permissions. The option stating to create a Customer Managed Key (CMK) and enable key rotation correctly addresses the limitation of AWS-managed keys (aws/s3), which cannot be modified to support cross-account access. The option stating to modify the S3 bucket policy and update the audit account's IAM role policy properly establishes the mutual trust relationship required for cross-account S3 operations.
Adım Adım Çözüm
Anahtar Kavram
Cross-account access to S3 buckets encrypted with KMS requires Customer Managed Keys (CMKs) rather than AWS-managed keys. Access must be explicitly granted on the KMS key policy, the S3 bucket policy, and the caller's IAM policy.
Tahmini Süre:2m 0s