Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer is deploying a containerized microservice to Amazon ECS that requires access to a customer managed key in AWS KMS for encrypting and decrypting application data. The security team prohibits direct, permanent IAM policy attachments to the ECS task role for KMS access. Instead, they require that permissions to use the KMS key be granted dynamically and programmatically to specific tasks at startup, and revoked when the tasks terminate. Which approach should the developer use to meet these security requirements?

  1. Call the CreateGrant API operation on the customer managed key, specifying the ECS task role as the grantee principal, and retire the grant when the task terminates.Answer
  2. B
    Retrieve the customer managed key's plaintext private key from AWS Secrets Manager dynamically during task initialization.
  3. C
    Call the GenerateDataKey API operation to obtain a plaintext data key, and pass this data key as a plain environment variable in the ECS task definition.
  4. D
    Modify the ECS task execution role's trust policy to allow kms.amazonaws.com to assume the role to perform cryptographic operations.

Answer

Call the CreateGrant API operation on the customer managed key, specifying the ECS task role as the grantee principal, and retire the grant when the task terminates.
Calling the CreateGrant API operation allows the microservice to dynamically grant the required cryptographic permissions on the customer managed key to the ECS task role at startup. The grant can then be retired programmatically using the RetireGrant operation when the task terminates, fulfilling the security requirement without permanent IAM policy attachments.

Step-by-Step Solution

1
Analyze the requirement for dynamic, programmatically managed, and temporary KMS permissions that avoid permanent IAM policies.
Identify that AWS KMS Grants allow programmatic, temporary delegation of key usage permissions to a principal.
Grants are designed precisely for scenarios where permissions must be given dynamically (e.g., at task startup) and revoked (retired) when no longer needed.
2
Evaluate the viability of using KMS Grants.
A grant can be created via the AWS SDK calling CreateGrant with the ECS task role as the grantee, specifying operations like Decrypt and Encrypt. When the task shuts down, the grant can be retired using the RetireGrant API call.
This avoids attaching permanent policy statements to the ECS task IAM role while ensuring the task has permissions only during its lifetime.

Key Concept

AWS KMS Grants provide a flexible, programmatic mechanism to delegate temporary access to KMS keys without changing IAM policies.
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic