Examkin

Soru

Zorluk: ZorS3 Reliability and Replication

A SysOps Administrator is troubleshooting a cross-account Amazon S3 Cross-Region Replication (CRR) setup. The source bucket in Account A (us-east-1) contains objects encrypted with a customer managed KMS key. The destination bucket in Account B (us-west-2) is configured to store the replicated objects. Versioning is enabled on both buckets, and an IAM role has been created in Account A to perform the replication. However, only unencrypted objects are successfully appearing in the destination bucket. Which action should the administrator take to ensure the encrypted objects are replicated?

  1. Configure the replication rule to include KMS-encrypted objects, specify the destination KMS key in Account B, and grant the replication IAM role permissions to decrypt using the Account A key and encrypt using the Account B key.Cevap
  2. B
    Temporarily suspend versioning on the destination bucket in Account B, and recreate the replication configuration to trigger a full resynchronization of the encrypted objects.
  3. C
    Attach an IAM policy to the replication IAM role in Account A that grants the iam:PassRole permission targeting the Amazon S3 service principal.
  4. D
    Modify the source KMS key policy in Account A to allow the destination S3 bucket ARN to directly call the kms:GenerateDataKey and kms:Decrypt API operations.

Cevap

Configure the replication rule to include KMS-encrypted objects, specify the destination KMS key in Account B, and grant the replication IAM role permissions to decrypt using the Account A key and encrypt using the Account B key.
The correct answer is to modify the replication rule to explicitly enable replication of KMS-encrypted objects, configure the destination KMS key, and provide the replication IAM role with decrypt permissions on the source key and encrypt/generate data key permissions on the destination key. S3 replication excludes KMS-encrypted objects by default and requires these configuration and permission updates to successfully replicate them.

Adım Adım Çözüm

1
Enable KMS-encrypted object replication in the S3 replication rule configuration.
Amazon S3 identifies objects encrypted with SSE-KMS as eligible for replication.
By default, S3 replication excludes objects encrypted using KMS keys. This must be explicitly enabled under SourceSelectionCriteria.
2
Update the replication IAM role policy in Account A to allow kms:Decrypt on the source KMS key.
The replication service gains permission to read and decrypt the source encrypted objects.
S3 needs to decrypt the source objects in Account A before they can be replicated.
3
Update the replication IAM role policy in Account A to allow kms:Encrypt and kms:GenerateDataKey on the destination KMS key in Account B.
The replication service gains permission to encrypt the replicated objects in the destination bucket.
The replication role must have permissions to encrypt the destination objects using Account B's KMS key.
4
Configure the KMS key policy in Account B to trust the replication IAM role from Account A.
The key policy in the destination account allows the replication IAM role from the source account to perform the necessary cryptographic operations.
Cross-account access requires permissions to be granted on both the IAM role and the resource policy of the destination KMS key.

Anahtar Kavram

Replication of KMS-encrypted objects in S3 requires explicit activation in the replication rule, decryption permissions on the source KMS key, and encryption permissions on the destination KMS key.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

S3 Reliability and Replication

Bu konudan daha fazla soru