Case Study: AWS strengthens multi-account AWS encryption with CloudQuery

AWS secures multi-account encryption with CloudQuery in 10-minute guide

The customer, Amazon Web Services (AWS), faced a challenge in its multi-account environments where cross-account access to encrypted resources, like an S3 bucket, was complex. Using AWS-managed KMS keys for this purpose was not possible, creating a significant hurdle for enterprise workloads split across different accounts for data and compute.

CloudQuery provided a solution by recommending the use of Customer Managed KMS Keys, specifically those with AWS-provided key material, to enable secure cross-account access. This approach allowed AWS to properly configure access via IAM roles and key policies between accounts, eliminating the access denial errors encountered with AWS-managed keys and simplifying the management of encrypted resources in a multi-account setup.

Amazon Web Services (AWS)