Only a specific application role should use encrypted customer data in an S3 bucket.
Prevent public access and unauthorized key use.
Choose TWO appropriate design elements.
Limit the S3 principal and actions with a bucket policy, and use SSE-KMS with a KMS key policy that also permits the application role to use the key.
Detailed explanation
A public key policy would remove the data-protection boundary.
A public key policy would remove the data-protection boundary.
Public access permits unintended principals and conflicts with least privilege.
Public access permits unintended principals and conflicts with least privilege.
A bucket policy can restrict the principal, actions, resources, and conditions for object access.
A bucket policy can restrict the principal, actions, resources, and conditions for object access.
SSE-KMS and the key policy jointly control encryption and use of the KMS key.
SSE-KMS and the key policy jointly control encryption and use of the KMS key.
Check official documentation
Compare the following points with the official documentation.
S3バケットポリシーとSSE-KMSの公式説明を確認する。
What to confirm
リソースアクセスと暗号鍵利用を別々のポリシーで最小権限にできる。
Key points
- S3 bucket policy
- SSE-KMS
- KMS key policy
- Principal restriction
Notes
- Environment: AWS公式S3・KMSドキュメントの確認
- Confirm current AWS service behavior and security guidance in the official documentation.
Foundation review
Separate boundaries
Object access and cryptographic-key use are distinct permissions that must be aligned.
Public access block
Avoiding public policy statements preserves the intended application-only boundary.