Examkin

Soru

Zorluk: Çok zorStrengthening Identity, Access, and Network Security

A digital banking application hosts its core processing engine on Amazon ECS tasks inside a private subnet of VPC-A in Account A. The application must retrieve daily financial statements from an Amazon S3 bucket in Account B. The S3 bucket is encrypted using SSE-KMS.

To comply with new security mandates, a solutions architect must implement the following changes:
1. Ensure all S3 data transfer is routed privately through an S3 Interface VPC Endpoint (vpce-s3-interface) in VPC-A, and all KMS decryption requests route privately through a KMS Interface VPC Endpoint (vpce-kms) in VPC-A.
2. Restrict access to the S3 bucket and the KMS key so that they only accept requests originating from their respective VPC endpoints in VPC-A.
3. Prevent any IAM identity in the organization from modifying or deleting the S3 bucket policy, with the sole exception of a break-glass IAM role (AdminRole) in Account B.

Which combination of actions will meet these requirements?

  1. A
    Configure the S3 bucket to use the default AWS-managed key (aws/s3) for encryption. Update the S3 bucket policy to allow the ECS task IAM role in Account A to read objects, restricted by a condition for vpce-s3-interface. Modify the aws/s3 key policy in Account B to allow the ECS task role to decrypt objects, restricted by a condition for vpce-kms. Attach an SCP to the OU containing Account B that denies s3:PutBucketPolicy and s3:DeleteBucketPolicy unless the principal is the AdminRole.
  2. Configure the S3 bucket to use a Customer Managed Key (CMK) in Account B for encryption. Update the S3 bucket policy to allow the ECS task IAM role in Account A to read objects, restricted by a condition for vpce-s3-interface. Update the KMS CMK key policy in Account B to allow the ECS task role to perform kms:Decrypt and kms:GenerateDataKey, restricted by a condition for vpce-kms. Attach an SCP to the OU containing Account B that denies s3:PutBucketPolicy and s3:DeleteBucketPolicy on the bucket, using a condition that excludes the AdminRole from the Deny effect.Cevap
  3. C
    Configure the S3 bucket to use a Customer Managed Key (CMK) in Account B for encryption. Update the S3 bucket policy to allow the ECS task IAM role in Account A to read objects, restricted by a condition for vpce-s3-interface. Update the KMS CMK key policy in Account B to allow the ECS task role to perform kms:Decrypt and kms:GenerateDataKey, restricted by a condition for vpce-kms. Attach an SCP to the OU containing Account B that unconditionally denies s3:PutBucketPolicy and s3:DeleteBucketPolicy on the bucket, relying on the local administrator permissions of AdminRole to override the organization-level SCP.
  4. D
    Configure the S3 bucket to use a Customer Managed Key (CMK) in Account B for encryption. Update the S3 bucket policy to allow the ECS task IAM role in Account A to read objects, restricted by a condition for vpce-s3-interface. Update the KMS CMK key policy in Account B to allow the ECS task role to perform kms:Decrypt and kms:GenerateDataKey, restricted by a condition for vpce-kms. Host a Route 53 Private Hosted Zone (PHZ) for the S3 and KMS interface VPC endpoints in Account B to manage private resolution, but do not associate this PHZ with VPC-A. Attach an SCP to the OU containing Account B that denies s3:PutBucketPolicy and s3:DeleteBucketPolicy unless the principal is the AdminRole.

Cevap

Configure the S3 bucket to use a Customer Managed Key (CMK) in Account B, configure S3 and KMS Interface VPC Endpoints in VPC-A, restrict policy conditions to their respective VPC endpoints, and attach an SCP with a condition that excludes the AdminRole from the Deny effect.
The correct configuration uses a Customer Managed Key (CMK) in Account B, because the default AWS-managed KMS key cannot have its key policy modified to grant cross-account permissions. It separates traffic across two distinct interface endpoints (S3 and KMS) in VPC-A and locks them down via specific endpoint ID checks. Finally, it uses an SCP containing a condition to exclude the AdminRole from the Deny effect, preventing other roles from tampering with the bucket policy while maintaining break-glass administrative access.

Adım Adım Çözüm

1
Determine the appropriate KMS key type for cross-account access.
Identify that a Customer Managed Key (CMK) must be used in Account B, as the default AWS-managed key policy cannot be modified to grant access to the cross-account role in Account A.
AWS-managed keys do not allow modification of their key policies to trust external accounts.
2
Configure network isolation for S3 and KMS data planes.
Utilize S3 and KMS Interface VPC Endpoints in VPC-A, and restrict access in the S3 bucket policy and KMS key policy to requests originating from these respective VPC endpoints using the aws:sourceVpce condition key.
This ensures that all data access and decryption requests are bound to the authorized VPC endpoints.
3
Formulate the Service Control Policy (SCP) to prevent unauthorized policy modification while allowing break-glass access.
Deploy an SCP with a Deny effect on s3:PutBucketPolicy and s3:DeleteBucketPolicy with a condition that excludes the specific AdminRole in Account B.
SCPs act as permission guards; an unconditional deny would block even local administrators, whereas a conditional deny preserves administrative access for the designated role.
4
Configure DNS resolution for private endpoints across accounts.
Ensure that any private hosted zones used for cross-account endpoint resolution are explicitly associated with VPC-A.
Private Hosted Zones must be associated with a VPC to allow DNS queries originating from that VPC to resolve successfully.

Anahtar Kavram

Strengthening cross-account access, network isolation with interface VPC endpoints, and governance with Service Control Policies.
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security