Which combination of steps should the solutions architect take to meet these requirements?
(Choose three.)
Create a bucket policy that includes read permissions for the S3 bucket. Set the principal of the bucket policy to the account ID of the Strategy account.
Update the strategy_reviewer IAM role to grant full permissions for the S3 bucket and to grant decrypt permissions for the custom KMS key.
Update the custom KMS key policy in the Creative account to grant decrypt permissions to the strategy_reviewer IAM role.
Create a bucket policy that includes read permissions for the S3 bucket. Set the principal of the bucket policy to an anonymous user.
Update the custom KMS key policy in the Creative account to grant encrypt permissions to the strategy_reviewer IAM role.
Update the strategy_reviewer IAM role to grant read permissions for the S3 bucket and to grant decrypt permissions for the custom KMS key.
Explanations:
A bucket policy is required to allow access from another account. Setting the principal to the Strategy account ID allows cross-account access specifically for users from that account.
Granting full permissions for the S3 bucket would exceed the minimum permissions required. Only read permissions for the S3 bucket and decrypt permissions for the KMS key are needed.
The KMS key policy must explicitly grant decrypt permissions to thestrategy_reviewerIAM role in the Strategy account to allow access to encrypted objects.
Setting the principal to an anonymous user would make the bucket accessible to anyone, violating the minimum permissions requirement.
Encrypt permissions are not needed for users in the Strategy account since they only need to view (decrypt) objects in the bucket, not to create or modify them.
Thestrategy_reviewerIAM role must have read permissions for the S3 bucket and decrypt permissions for the KMS key to meet the minimum permissions required for viewing objects.