Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is implementing a microservice on Amazon ECS that needs to decrypt application configuration data using a customer managed key stored in AWS KMS. The developer attaches an IAM policy to the ECS Task Role that grants the `kms:Decrypt` permission for the specific KMS key. However, the microservice fails to decrypt the data and receives an `AccessDeniedException`. Which of the following is the most likely explanation for this authorization failure?

  1. The key policy associated with the customer managed key does not explicitly permit the ECS Task Role to perform the action, and it does not contain a statement allowing the AWS account to delegate permissions via IAM policies.Answer
  2. B
    The `kms:Decrypt` permission must be attached to the ECS Task Execution Role instead of the ECS Task Role to allow the containerized application to call the KMS API.
  3. C
    The ECS Task Role is not permitted to call the AWS KMS API directly, so the developer must store the configuration as a SecureString in AWS Systems Manager Parameter Store.
  4. D
    The customer managed key is a symmetric key, which restricts direct decryption API calls and requires the application to implement client-side envelope encryption.

Answer

The key policy associated with the customer managed key does not explicitly permit the ECS Task Role to perform the action, and it does not contain a statement allowing the AWS account to delegate permissions via IAM policies.
The correct answer explains that for customer managed keys, the KMS key policy is the ultimate authority. An IAM policy cannot grant access to a KMS key unless the key policy explicitly allows the principal or delegates authority to the AWS account to allow IAM-based delegation. Without this key policy configuration, KMS calls will result in an AccessDeniedException.

Step-by-Step Solution

1
Analyze the IAM policy and the error message.
The ECS Task Role has the required IAM permission (`kms:Decrypt`), but the application receives an `AccessDeniedException` from KMS.
To determine if the issue is inside the IAM policy or elsewhere in AWS KMS authorization.
2
Recall AWS KMS evaluation logic for key policies and IAM policies.
KMS requires an explicit allowance in the KMS key policy. Unlike other services, IAM policies alone cannot grant access to a KMS key unless the key policy delegates authority to the account's IAM policies.
To identify where the missing permission configuration resides.
3
Evaluate the key policy requirements for a customer managed key.
The key policy must either explicitly list the ECS Task Role's ARN as a principal allowed to call `kms:Decrypt`, or it must delegate permission to the account root principal, which then allows IAM policies to grant the permission.
To select the correct reason for the authorization failure.

Key Concept

AWS KMS Key Policies vs IAM Policies
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic