Problem Analysis:
The company needs cross-account access to allow QuickSight in BI-Account to interact with an S3 bucket in Hub-Account.
The bucket is encrypted with an AWS KMS key.
Appropriate permissions must be set for both S3 access and KMS decryption.
Key Considerations:
QuickSight requires IAM permissions to access S3 data and decrypt files using the KMS key.
Both S3 and KMS permissions need to be properly configured across accounts.
Solution Analysis:
Option A: Use Existing KMS Key for Encryption
While the existing KMS key is used for encryption, it must also grant decryption permissions to QuickSight.
Option B: Add S3 Bucket to QuickSight Role
Granting S3 bucket access to the QuickSight service role is necessary for cross-account access.
Option C: AWS RAM for Bucket Sharing
AWS RAM is not required; bucket policies and IAM roles suffice for granting cross-account access.
Option D: IAM Policy for KMS Access
QuickSight’s service role in BI-Account needs explicit permissions to use the KMS key for decryption.
Option E: Add KMS Key as Resource for Role
The KMS key must explicitly list the QuickSight role as an entity that can access it.
Implementation Steps:
S3 Bucket Policy in Hub-Account:Add a policy to the S3 bucket granting the QuickSight service role access:
json
{
" Version " : " 2012-10-17 " ,
" Statement " : [
{
" Effect " : " Allow " ,
" Principal " : { " AWS " : " arn:aws:iam:: < BI-Account-ID > :role/service-role/QuickSightRole " },
" Action " : " s3:GetObject " ,
" Resource " : " arn:aws:s3::: < Bucket-Name > /* "
}
]
}
KMS Key Policy in Hub-Account:Add permissions for the QuickSight role:
{
" Version " : " 2012-10-17 " ,
" Statement " : [
{
" Effect " : " Allow " ,
" Principal " : { " AWS " : " arn:aws:iam:: < BI-Account-ID > :role/service-role/QuickSightRole " },
" Action " : [
" kms:Decrypt " ,
" kms:DescribeKey "
],
" Resource " : " * "
}
]
}
IAM Policy for QuickSight Role in BI-Account:Attach the following policy to the QuickSight service role:
{
" Version " : " 2012-10-17 " ,
" Statement " : [
{
" Effect " : " Allow " ,
" Action " : [
" s3:GetObject " ,
" kms:Decrypt "
],
" Resource " : [
" arn:aws:s3::: < Bucket-Name > /* " ,
" arn:aws:kms: < region > : < Hub-Account-ID > :key/ < KMS-Key-ID > "
]
}
]
}
Setting Up Cross-Account S3 Access
AWS KMS Key Policy Examples
Amazon QuickSight Cross-Account Access
