Examkin

Question

Difficulty: HardAWS KMS and Encryption

An application deployed on AWS Lambda in Account A (111122223333111122223333) needs to retrieve and decrypt S3 objects from an Amazon S3 bucket located in Account B (444455556666444455556666). The S3 bucket is configured with Server-Side Encryption (SSE-KMS) using a KMS customer managed key.

Which two AWS KMS configuration steps are required to enable the Lambda function to decrypt the objects? (Select TWO.)

  1. In Account B, modify the KMS customer managed key's key policy to grant the Lambda execution role in Account A permission to perform the kms:Decrypt action.Answer
  2. In Account A, attach an IAM policy to the Lambda execution role that grants the kms:Decrypt permission on the ARN of the customer managed key in Account B.Answer
  3. C
    In Account B, configure the S3 bucket policy to grant kms:Decrypt permissions to the Lambda execution role from Account A.
  4. D
    Configure the S3 bucket in Account B to use the default AWS managed key aws/s3 for encryption and grant the Lambda execution role kms:Decrypt permission on that key.
  5. E
    In Account A, store the KMS key's plaintext backing key in Systems Manager Parameter Store as a SecureString parameter and grant the Lambda execution role read access.

Answer

The Lambda function execution role requires permissions in both accounts: a KMS key policy update in Account B to allow the role to perform the kms:Decrypt operation, and an IAM policy in Account A allowing the role to call the kms:Decrypt action on the key's ARN in Account B.
For cross-account access to KMS keys, permissions must be granted by both the resource owner (Account B) and the consumer (Account A). First, the KMS customer managed key's policy in Account B must be modified to trust and allow the Lambda execution role ARN from Account A to perform the decryption operation. Second, the Lambda execution role in Account A must have an IAM policy attached that permits it to perform the decryption action against the KMS key ARN in Account B.

Step-by-Step Solution

1
Examine the cross-account requirements for SSE-KMS decryption.
Identify that both S3 access and KMS key access are required, and that KMS cross-account access requires permissions in both the key policy (trusting account) and the IAM policy (trusted account).
KMS evaluates authorization in both the caller's account and the resource-owning account for cross-account requests.
2
Configure the key-owning account (Account B).
Modify the customer managed key's key policy in Account B to grant kms:Decrypt permissions to the specific Lambda execution role ARN in Account A.
This establishes trust from the resource owner to the external identity.
3
Configure the caller's account (Account A).
Attach an IAM policy to the Lambda execution role in Account A granting kms:Decrypt on the specific customer managed key ARN from Account B.
This grants the identity the authority to call KMS across accounts.

Key Concept

Cross-account KMS authorization requires permission grants in both the KMS key policy (resource-based) and the caller's IAM policy (identity-based), and AWS managed keys do not support cross-account sharing.
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic