What is the MOST secure way for the solutions architect to share the AMI with the MSP Partner’s AWS account?
Make the encrypted AMI and snapshots publicly available. Modify the key policy to allow the MSP Partner’s AWS account to use the key.
Modify the launchPermission property of the AMI. Share the AMI with the MSP Partner’s AWS account only. Modify the key policy to allow the MSP Partner’s AWS account to use the key.
Modify the launchPermission property of the AMI. Share the AMI with the MSP Partner’s AWS account only. Modify the key policy to trust a new KMS key that is owned by the MSP Partner for encryption.
Export the AMI from the source account to an Amazon S3 bucket in the MSP Partner’s AWS account, Encrypt the S3 bucket with a new KMS key that is owned by the MSP Partner. Copy and launch the AMI in the MSP Partner’s AWS account.
Explanations:
Making the AMI and snapshots publicly available significantly reduces security. Although modifying the key policy might allow the MSP Partner’s AWS account to use the key, the public availability exposes sensitive data to all AWS users, increasing the risk of unauthorized access.
This option correctly modifies the launchPermission property to share the AMI only with the MSP Partner’s AWS account while ensuring the KMS key policy allows the partner to use the existing key. This maintains security by restricting access and keeping the AMI and snapshots private.
While modifying the launchPermission property to share the AMI is correct, using a new KMS key owned by the MSP Partner is not the most secure method. This would require transferring the key management to the partner, which may pose risks. Keeping the original KMS key and modifying its policy is more secure.
Although exporting the AMI to an S3 bucket in the MSP Partner’s account can work, it introduces complexities and potential risks, such as managing S3 bucket permissions and the use of a new KMS key owned by the partner. Additionally, this method may not be as direct or efficient as sharing the AMI directly through the existing KMS key permissions.