1.3 - Cross-account data protection and access (KMS, S3 Access Points, delegated admin)

1. An application in two Regions must encrypt data with a key that has one identity and shared ciphertext portability, so data encrypted in one Region decrypts in the other without re-encryption. Which TWO facts about the design are correct? (Choose TWO.)

• A standard single-Region KMS key can be replicated to any Region by toggling a setting
• Use a KMS multi-Region key with a primary and a replica sharing the same key material (correct answer)
• Ciphertext produced by one replica can be decrypted by the related replica in the other Region (correct answer)
• Each Region needs a completely unrelated KMS key and the application must decrypt and then re-encrypt the data on every transfer

Multi-Region keys are created as such (a normal key cannot be converted) with a primary and replicas that share key material and key ID, so ciphertext is portable and either replica decrypts the other's output without re-encryption. Ordinary independent keys would force a decrypt/re-encrypt cycle on cross-Region transfer.

2. A platform team wants developers to launch only approved, pre-configured stacks (for example a compliant Amazon RDS setup) without granting them broad IAM permissions to the underlying services. Which service provides this self-service catalog?

• AWS Service Catalog (correct answer)
• AWS Systems Manager Parameter Store
• AWS Config
• AWS Marketplace private offers negotiated with third-party vendors

Service Catalog lets admins publish approved products (CloudFormation templates) that users launch with a launch role, so users get the resources without direct broad permissions. Parameter Store stores config values, Config tracks compliance, and Marketplace sells third-party software.

3. A central team maintains a Service Catalog portfolio and wants every account in the organization to access it so end users launch products locally, without importing it account by account. How should they share it?

• Share the portfolio with the organization or specific OUs via Organizations integration (correct answer)
• Copy every product template into each account and republish it there manually
• Make the portfolio publicly accessible over the internet to anyone with the link
• Grant each individual developer direct cross-account console access into the central management account

Service Catalog integrates with Organizations to share a portfolio to the whole org or chosen OUs, so accounts import it automatically and users launch locally. Manual copying does not scale, public exposure is insecure, and cross-account console access bypasses the self-service model entirely.

4. A team standardizes on Terraform and wants a GitOps pipeline to provision and continuously customize Control Tower accounts. Which AWS solution fits?

• Account Factory for Terraform (AFT) (correct answer)
• The Control Tower console wizard clicked manually for each individual account
• AWS CloudFormation StackSets used exclusively, with no Terraform involved anywhere
• A plain terraform apply run by hand in each account without any pipeline or automation

AFT provides a Terraform/GitOps pipeline that provisions Control Tower accounts via Account Factory and applies customizations automatically. The console wizard is manual, StackSets are CloudFormation-based, and per-account manual terraform apply has no pipeline or governance.

5. An application in account A must read objects from an unencrypted S3 bucket owned by account B. What is the minimal configuration that grants this access?

• Enable cross-Region replication so account A permanently holds a full duplicate copy of the bucket contents
• Make the bucket public and rely on account A network controls to restrict who reads it
• A bucket policy in B allowing A's role, plus an identity policy on that role allowing s3:GetObject (correct answer)
• Turn off S3 Block Public Access on both accounts and share every object with account A through pre-signed URLs regenerated on a schedule

Cross-account S3 access needs BOTH sides to allow it: the resource owner (B) grants A's principal in the bucket policy, and A's own identity policy permits the action. Replication is wasteful and stale; making the bucket public or disabling Block Public Access is insecure and unnecessary.

6. Account A must read S3 objects in account B that are encrypted with an SSE-KMS customer managed key owned by B. Beyond the bucket policy and A's identity policy, which TWO additional grants are required? (Choose TWO.)

• A NAT gateway in account A so decryption traffic can reach the KMS regional endpoint over the public internet
• The key policy on B's KMS key must allow A's principal to call kms:Decrypt (correct answer)
• A separate KMS key created in account A to re-wrap the objects after download
• A's identity policy must also allow kms:Decrypt on B's key ARN (correct answer)
• Enabling S3 Bucket Keys, which removes the need for any KMS permission at all

To decrypt SSE-KMS objects cross-account you need the key policy on B's key to permit A's principal AND A's identity policy to allow kms:Decrypt on that key ARN. A NAT gateway is irrelevant, a new key cannot decrypt B's ciphertext, and Bucket Keys reduce KMS call volume but do not remove the permission requirement.