Examkin

Question

Difficulty: Very hardAWS KMS and Encryption

A developer is building a high-throughput microservice deployed on AWS Fargate that processes sensitive financial transactions. The system must encrypt each transaction payload client-side before storing it in an Amazon DynamoDB table. To meet strict security compliance, the team has established the following requirements:

1. Access to the AWS Key Management Service (AWS KMS) customer managed key (CMK) must be managed centrally using IAM policies, avoiding direct updates to the KMS key policy whenever a new microservice is deployed.
2. The microservice's IAM execution role (`TxServiceRole`) must be granted the absolute minimum permissions required to perform local client-side envelope encryption.

Which two configuration steps must the developer perform to satisfy these requirements? (Select TWO.)

  1. Include a statement in the KMS key policy of the customer managed key that grants the AWS account root user (`arn:aws:iam::<ACCOUNT_ID>:root`) permission to perform all KMS actions (`kms:*`).Answer
  2. Attach an IAM policy to the `TxServiceRole` that grants permission to perform the `kms:GenerateDataKey` action on the ARN of the customer managed key.Answer
  3. C
    Attach an IAM policy to the `TxServiceRole` that grants permission to perform the `kms:Encrypt` and `kms:Decrypt` actions on the ARN of the customer managed key.
  4. D
    Attach an IAM policy to the `TxServiceRole` that grants permission to perform the `kms:GenerateDataKeyWithoutPlaintext` action on the ARN of the customer managed key.
  5. E
    Configure the microservice to store the generated plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to reuse across transaction sessions.

Answer

To configure client-side envelope encryption with IAM-based access management, the KMS key policy must delegate permission control to IAM by granting the account root user permissions to perform all KMS actions. Additionally, the microservice execution role must be granted permissions in IAM to run the `kms:GenerateDataKey` action on the key.
The correct configuration requires delegating control of the KMS Customer Managed Key (CMK) to IAM, and granting the microservice the minimal API action required for envelope encryption. Delegating control to IAM is achieved by adding a policy statement to the key policy that grants `kms:*` to the account's root user. The microservice requires the `kms:GenerateDataKey` action to retrieve both the plaintext and encrypted versions of the data key needed to perform envelope encryption client-side.

Step-by-Step Solution

1
Configure the KMS key policy to delegate authorization to IAM.
Include a statement in the KMS key policy that grants the root user (`arn:aws:iam::<ACCOUNT_ID>:root`) permission to perform `kms:*` operations.
This is a prerequisite for managing KMS key access centrally via IAM policies. Without this statement, IAM policies granting access to the key will be ignored.
2
Determine the necessary KMS API action for envelope encryption.
Identify that the application needs to run `GenerateDataKey` to retrieve both the plaintext and ciphertext versions of the data key.
Envelope encryption requires the plaintext key to encrypt the payload locally and the ciphertext key to store with the encrypted payload for later decryption.
3
Attach the minimum required IAM permissions to the microservice role.
An IAM policy allowing `kms:GenerateDataKey` on the key ARN is attached to the role.
This implements the principle of least privilege, giving the microservice only the permission it needs to generate keys for client-side encryption without granting administrative or direct encryption capabilities.

Key Concept

KMS Key Policies and Envelope Encryption Integration
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic