Amazon AWS SCS-C03: Data Protection Across AWS Accounts
Protecting data across many AWS accounts requires more than enabling encryption in each workload. The enterprise needs organization-wide guardrails for public exposure, clear key ownership, sensitive-data discovery, cross-account resource policies, protected backups, and an operating model that separates workload administrators from the security controls meant to limit them. Multi-account architecture helps because one compromised workload account does not have to control the keys, logs, backups, or policy layers that protect every other account.
AWS now provides several organization-level controls that make this easier. Amazon S3 Block Public Access can be enforced through AWS Organizations policies across selected OUs or accounts, and the most restrictive applicable setting wins. Amazon Macie can use a delegated administrator to inventory S3 and run automated sensitive-data discovery across member accounts. KMS key policies, IAM, grants, and cross-account resource policies still determine who can use encryption keys. These controls work together; none of them replaces application-level authorization.
Cross-account data protection therefore belongs inside AWS Security Engineering.
Start with account boundaries
Separate production workloads, security tooling, log archive, backup, and shared platform services according to risk and ownership.
Multi-account governance reduces blast radius because a workload administrator does not automatically control the account that stores centralized logs or security evidence.
Account structure should make the intended trust boundaries visible before policies are written.
Block public S3 access centrally
S3 Block Public Access can be applied at organization, account, bucket, and access-point levels.
AWS currently supports organization-level S3 policies that enforce all four Block Public Access settings for selected organization scopes.
Use that baseline where public buckets are not a valid business pattern, and require explicit architecture review for any workload that genuinely needs internet-public object access.
Use bucket and access policies for least privilege
Block Public Access prevents broad public exposure, but private cross-account access still depends on IAM and resource policies.
Bucket policies should name trusted principals, organizations, VPC endpoints, or other supported conditions narrowly enough to express the business relationship.
Data protection is strongest when the access path is explicit instead of relying on wildcard principals that happen to be hidden behind another guardrail.
Keep KMS key authority separate
KMS key policies are the primary resource policies for customer-managed KMS keys.
AWS encryption should separate key administrators from key users where the business requires stronger control.
Cross-account use should be granted deliberately through the key policy plus IAM permissions in the consuming account, rather than by placing every principal into one broad key policy.
Discover sensitive data with Macie
Amazon Macie can centrally manage S3 security posture and sensitive-data discovery across an AWS Organization.
The delegated Macie administrator can access S3 inventory information for member accounts and can enable automated sensitive-data discovery according to current regional configuration.
Use Macie findings to identify where sensitive data actually exists, then connect those findings to ownership and remediation instead of treating classification as a reporting exercise.
Establish a data perimeter
AWS describes a data perimeter as organization-wide preventive guardrails that help ensure trusted identities access trusted resources from expected networks.
Policies can use organization context, account context, VPC endpoint context, and service-specific condition keys where supported.
The perimeter complements fine-grained IAM; it does not replace the application policies that decide which user can read which object or database row.
Protect backups outside the workload path
Recovery copies should be protected from the same administrator or attacker who can alter production data.
Use separate backup accounts, vault protections, encryption, and retention controls according to workload requirements and current AWS Backup capabilities.
A backup architecture is useful only when the enterprise can restore data after accidental deletion, corruption, ransomware, or account compromise.
Centralize evidence, not control of all data
Centralized logging should give responders access to CloudTrail, Config, and security evidence without giving the central analytics role write access to workload data.
Similarly, security administrators can see Macie findings or Security Hub signals without becoming default owners of every production bucket.
Central security needs visibility; workload teams keep operational context and data stewardship.
Review data protection as a lifecycle
New accounts, Regions, services, buckets, keys, data stores, and third-party integrations can all change the data perimeter.
For SCS-C03, the durable pattern is account boundary → public-access guardrail → least-privilege resource policy → KMS authority → discovery/classification → backup protection → central evidence → periodic review.
Data protection at scale works when a new workload inherits secure defaults automatically and exceptions remain visible, justified, and temporary.
Organization-level S3 Block Public Access is especially useful because it creates a baseline that member accounts cannot weaken locally while the policy is attached. AWS currently applies the organization policy through the Organizations hierarchy and S3 enforces the most restrictive applicable setting across organization/account and bucket levels. This lets security teams express “public S3 is not a valid pattern here” once instead of relying on every workload owner to remember four settings forever.
That baseline should still include an exception path. Some businesses intentionally publish static assets or public datasets. Rather than disabling protection broadly, isolate public workloads into dedicated accounts or scopes whose policy and monitoring reflect that business purpose. Public data should be public by design, not because a project disabled an inherited protection to fix an access error.
S3 Object Ownership and ACL strategy also matter. New S3 designs generally benefit from bucket-owner-enforced ownership and policy-based access rather than legacy ACL-heavy models. Fewer authorization mechanisms make cross-account reviews easier because investigators can focus on IAM, bucket policy, access points, and organization guardrails instead of several overlapping ACL grants.
KMS cross-account design deserves the same clarity. The key-owning account can keep administrative control while selected principals in workload accounts receive cryptographic use. This is valuable when a central security or data platform team must protect keys from accidental workload deletion or policy change. The tradeoff is an additional dependency: if the key-owning account or policy is misconfigured, workloads across several accounts can lose access simultaneously.
Resource control policies and service control policies can provide organization-level boundaries around data access according to current AWS Organizations capabilities. They are strongest when used for simple non-negotiable statements—such as denying untrusted organization access—rather than attempting to encode every application authorization rule centrally. Fine-grained business access still belongs close to the resource and identity.
Macie should be used as a discovery and prioritization service, not as a replacement for data classification ownership. Automated sensitive-data discovery can sample S3 objects and help identify where personal, financial, credential, or other sensitive patterns appear, but application owners still know why that data exists and whether the result is expected. Findings should flow into remediation or classification review with a named owner.
Macie organization architecture is Regional. The delegated administrator can manage member-account coverage in each Region where Macie is configured. Enterprises using many Regions should therefore maintain a Region inventory and ensure that “central Macie” does not create a false assumption that one Region’s administrator view covers every S3 bucket globally.
Data protection also includes data in transit. TLS should be enforced for service access where supported, private connectivity can reduce exposure, and service policies can require secure transport. These controls address network exposure, while IAM and KMS address who can access and decrypt the data. Layering them is stronger than expecting one encrypted-at-rest checkbox to solve the whole problem.
Secrets and credentials should be kept out of general-purpose data stores. If Macie repeatedly finds API keys, passwords, or tokens in S3, the right response is usually to improve the application secret-management pattern rather than merely add another bucket policy. Sensitive-data discovery can reveal architecture debt that encryption alone would have hidden.
Backup protection should consider cross-account and logically isolated recovery. Workload administrators who can delete production data should not automatically be able to delete every recovery copy. Depending on the service and threat model, organizations can use separate backup accounts, protected vaults, retention controls, and tightly restricted KMS authority so destructive actions require crossing another security boundary.
Deletion and retention are privacy and security decisions. Encryption protects confidentiality, but keeping sensitive data forever increases breach and discovery exposure. S3 lifecycle, backup retention, log retention, and data-classification requirements should be aligned so the organization knows when copies are supposed to expire and which exceptions must remain for legal or recovery reasons.
Cross-account data flows should be documented from producer to consumer. Name the source account, target resource, IAM role, resource policy, KMS key, network path, logging, and data owner. When the flow is represented as one architecture object, reviewers can see whether an external role has more permission than the business exchange actually requires.
Security testing should include negative cases. A principal from an untrusted account should fail to read the bucket, a workload without the KMS grant should fail to decrypt, a public policy should be blocked by S3 controls, and a deleted production record should remain recoverable only through the intended backup process. These tests prove the perimeter rather than assuming policy documents are correct.
Finally, data-protection governance should include change alerts. A bucket-policy change, KMS key-policy update, organization-policy detachment, Macie disablement, or backup-retention change can materially alter risk without touching application code. CloudTrail and configuration monitoring should make those control-plane changes visible to the teams responsible for the data.
The mature enterprise can answer four questions for every sensitive dataset: where it lives, who can access it, which key protects it, and how it is recovered or deleted. Multi-account AWS controls are valuable because they make those answers enforceable across many workloads instead of relying on project-by-project discipline.