Examkin

Soru

Zorluk: OrtaEnhancing Data Protection and Compliance

An enterprise operates a multi-account environment governed by AWS Organizations. Log files containing sensitive operational records are collected from all member accounts and consolidated into a centralized Amazon S3 bucket located in a dedicated Security account. The S3 bucket is currently encrypted using the default AWS-managed KMS key (aws/s3). A solutions architect must design a solution that enhances data protection and meets the following compliance requirements:
- All log objects must be encrypted at rest using a key that supports automatic annual rotation.
- The security audit team in the Security account must be able to decrypt and analyze the logs, but member accounts must be blocked from decrypting logs once they have been written.
- Member accounts must be prevented from deleting the S3 logging bucket, deleting any log objects, or modifying the bucket policy, even if users in those accounts have administrative privileges.

Which two actions should the solutions architect take to meet these requirements?

  1. Create a Customer Managed Key (CMK) in the Security account, enable automatic key rotation, and configure a key policy that allows member accounts to use the kms:GenerateDataKey action while restricting the kms:Decrypt action to the security audit team.Cevap
  2. Create and attach a Service Control Policy (SCP) to the AWS Organizations root that denies s3:DeleteBucket, s3:DeleteObject, and s3:PutBucketPolicy on the logging S3 bucket resources for all member accounts.Cevap
  3. C
    Modify the key policy of the default AWS-managed KMS key (aws/s3) in the Security account to allow cross-account access for the member accounts and the security audit team.
  4. D
    Attach a Service Control Policy (SCP) to the Organizational Unit (OU) containing the Security account that explicitly grants s3:GetObject and kms:Decrypt permissions to the security audit team, removing the requirement to configure local IAM policies.
  5. E
    Configure the S3 bucket policy in the Security account to allow s3:PutObject actions using a wildcard (*) principal and omitting the aws:PrincipalOrgID condition, relying on the default AWS-managed key to restrict cross-account object access.

Cevap

Create a Customer Managed Key (CMK) in the Security account with a key policy that allows member accounts to use the key generation action while restricting decryption to the security audit team, and enable automatic key rotation. Create and attach a Service Control Policy (SCP) to the AWS Organizations root that denies deletion of the S3 logging bucket, deletion of any log objects, and modifications to the bucket policy for all member accounts.
To satisfy the requirements, the solutions architect must use a Customer Managed Key because AWS-managed keys cannot be shared across accounts or have customized key policies. The CMK must allow member accounts to write logs (kms:GenerateDataKey) but deny them decryption capability, which is reserved for the security audit team. Furthermore, a Service Control Policy attached to the Organization root is the only mechanism that can restrict actions like bucket and object deletion for all member accounts, overriding even administrative privileges within those accounts.

Adım Adım Çözüm

1
Address KMS key requirements by creating a Customer Managed Key in the Security account.
This key can have its key policy modified to allow cross-account usage and supports automatic annual rotation, unlike AWS-managed keys.
Regulatory compliance requires automatic rotation and cross-account access control, which is only supported via Customer Managed Keys.
2
Configure the key policy for the Customer Managed Key to restrict access to only what is necessary.
Member accounts are granted the kms:GenerateDataKey permission to perform uploads, while only the security audit team is granted kms:Decrypt.
This implements the principle of least privilege, preventing member accounts from reading logs once they are written.
3
Apply a Service Control Policy (SCP) at the AWS Organizations root targeting member accounts.
The SCP denies s3:DeleteBucket, s3:DeleteObject, and s3:PutBucketPolicy actions on the centralized logging bucket resources.
SCPs act as permission guardrails, preventing even administrative users in member accounts from deleting logs or altering the logging configuration.

Anahtar Kavram

Delegating least-privilege cross-account access using Customer Managed Keys (CMKs) and securing compliance logs using Service Control Policies (SCPs) in AWS Organizations.
Bu soruyu puanla

Konular

Enhancing Data Protection and Compliance