Examkin

Soru

Zorluk: OrtaS3 Reliability and Replication

A SysOps Administrator is troubleshooting a cross-account Same-Region Replication (SRR) setup between a source S3 bucket in Account A and a destination S3 bucket in Account B. Objects in the source bucket are encrypted with a customer managed AWS KMS key in Account A. The destination bucket is also encrypted with a customer managed AWS KMS key in Account B. The administrator notices that replication fails for new objects, and their replication status is marked as FAILED. Which combination of actions will resolve this replication failure? (Select two.)

  1. Configure the IAM replication role in Account A with permissions to decrypt using the source KMS key, and ensure that the source KMS key policy allows the replication role to perform the decryption.Cevap
  2. Modify the key policy of the destination KMS key in Account B to grant the replication role in Account A permissions to perform the GenerateDataKey and Encrypt operations.Cevap
  3. C
    Add a statement to the trust policy of the replication role in Account A to allow the destination S3 bucket in Account B to perform the iam:PassRole action.
  4. D
    Disable S3 Versioning on the destination bucket in Account B to ensure that the replica objects do not conflict with the source bucket's version history.
  5. E
    Update the source KMS key policy in Account A to grant decrypt permissions directly to the destination S3 bucket's Amazon Resource Name (ARN) as the principal.

Cevap

Configure the replication role in Account A with decrypt permissions on the source KMS key (with the key policy allowing it), and update the destination KMS key policy in Account B to allow the replication role to generate data keys and encrypt objects.
The option to configure the IAM replication role with decrypt permissions on the source KMS key (along with the key policy allowing it) is correct because the replication process must first read and decrypt the source objects. The option to grant GenerateDataKey and Encrypt permissions in the destination KMS key policy to the replication role is correct because cross-account access to KMS keys must be explicitly allowed by the KMS key policy in the target account.

Adım Adım Çözüm

1
Analyze source-side KMS decryption requirements.
The replication role in Account A needs permission to decrypt the source objects using the KMS key in Account A.
Since the source objects are encrypted with a customer managed KMS key, S3 replication cannot read the objects to replicate them without kms:Decrypt permissions.
2
Analyze destination-side KMS encryption requirements.
The replication role in Account A needs permission to encrypt objects using the KMS key in Account B.
Because the destination bucket uses a customer managed KMS key in a different account, the cross-account replication role must be allowed to perform kms:Encrypt and kms:GenerateDataKey operations using the destination key policy.

Anahtar Kavram

To replicate KMS-encrypted objects across accounts, the S3 replication IAM role must have decrypt permissions on the source key, and the destination key policy must explicitly trust the replication role for encrypt operations.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

S3 Reliability and Replication

Bu konudan daha fazla soru