Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer has configured an application running on an Amazon EC2 instance to decrypt database credentials using an AWS KMS customer managed key. The EC2 instance profile has an IAM policy attached that allows the `kms:Decrypt` action on the key's Amazon Resource Name (ARN). However, the application receives an `AccessDeniedException` error when attempting to decrypt the credentials. Which configuration change is required to resolve this authorization error?

  1. A
    Update the trust policy of the EC2 instance's IAM role to allow the `kms.amazonaws.com` service principal to assume the role.
  2. Modify the KMS key policy to grant the EC2 instance's IAM role permission to perform the `kms:Decrypt` action.Answer
  3. C
    Use the `GenerateDataKey` API operation to download the plaintext private key of the customer managed key, storing it locally to decrypt the credentials without invoking KMS.
  4. D
    Migrate the credentials to Systems Manager Parameter Store as a Standard string parameter to bypass AWS KMS validation checks.

Answer

Modify the KMS key policy to grant the EC2 instance's IAM role permission to perform the `kms:Decrypt` action.
For AWS KMS customer managed keys, authorization is determined by both the key policy and IAM policies. If the key policy does not explicitly permit the caller or delegate authority to the root AWS account (which allows IAM policies to take effect), any IAM policies permitting KMS actions will have no effect, resulting in an AccessDeniedException. Granting the EC2 role access in the key policy resolves the issue.

Step-by-Step Solution

1
Determine the resource authorization hierarchy for AWS KMS.
Unlike other services, AWS KMS requires that the key policy itself explicitly grants access, either directly or by delegating control to the account's IAM policies.
If the key policy is not configured to trust the IAM role or the root account, all IAM permissions for that key will be ignored.
2
Verify if the key policy of the customer managed key contains an allow statement for the caller's IAM role.
The key policy does not delegate control or explicitly authorize the EC2 role.
This results in an AccessDeniedException despite the presence of the IAM policy.
3
Add the required permissions statement to the KMS key policy.
The key policy is updated to include the EC2 instance profile's IAM role ARN as a Principal with the `kms:Decrypt` action.
This satisfies the KMS authorization check and allows the application to decrypt the credentials.

Key Concept

AWS KMS Key Policy Authorization
Estimated Time:1m 30s
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic