Which combination of steps should the security team take so that the automation can capture EC2 forensic evidence in all AWS accounts in the organization?

Explanations:

The AWS managed KMS keys cannot have their key policies modified, as they are controlled by AWS. Therefore, updating the KMS key policy for the AWS managed key is not an option.

Creating a customer managed KMS key in the target account and updating the IAM role to allow necessary KMS actions ensures that the automation can encrypt and decrypt snapshots successfully. This allows for more granular control over key permissions.

The security team’s IAM role cannot manage permissions for AWS managed keys across accounts. Since the AWS managed key policy cannot be updated, this option would not resolve the issue.

Updating the automation’s IAM role in the security team’s AWS account to allow necessary actions for the customer managed KMS key will enable it to encrypt and decrypt the snapshots correctly when they are copied.

The AWS managed KMS key policy cannot be updated, and while the automation code could take EBS snapshots, it wouldn’t resolve the permissions issues since it can’t modify KMS actions for the managed key.

Updating the automation code to use a customer managed KMS key allows for greater control and proper permissions for encrypting snapshots in the security team’s account, ensuring that the snapshots can be copied successfully.