Examkin

Question

Difficulty: MediumAWS KMS and Encryption

A developer creates a customer managed key in AWS KMS to encrypt sensitive configuration payloads. The developer then attaches an IAM policy to an IAM role associated with an Amazon EC2 instance. The IAM policy grants permission for the `kms:Decrypt` action on the key's Amazon Resource Name (ARN). However, when the application running on the EC2 instance attempts to call the Decrypt API, it receives an `AccessDeniedException`. Which of the following is the most likely cause of this authorization failure?

  1. The key policy for the customer managed key does not contain a statement that delegates permissions to the AWS account, which is required for IAM policies to grant access to the key.Answer
  2. B
    The developer needs to configure a trust policy on the KMS key itself that explicitly lists the IAM role of the EC2 instance as a trusted entity.
  3. C
    The payload being decrypted is stored in Systems Manager Parameter Store as a SecureString parameter, which ignores KMS key policies and relies solely on Parameter Store policies.
  4. D
    The application must perform client-side envelope encryption locally to decrypt the ciphertext, which bypasses the need for the `kms:Decrypt` API call.

Answer

The key policy for the customer managed key does not contain a statement that delegates permissions to the AWS account, which is required for IAM policies to grant access to the key.
For customer managed keys, AWS KMS evaluates both the key policy and the IAM policies. For an IAM policy to successfully grant access, the KMS key policy must contain a statement that delegates permission to the AWS account (specifically referencing the account's root principal ARN). If this delegation is missing, IAM policy permissions on the key are ignored, resulting in an AccessDeniedException.

Step-by-Step Solution

1
Analyze the IAM policy and the error.
The IAM policy grants the necessary `kms:Decrypt` permissions to the EC2 instance's IAM role, but the application still receives an `AccessDeniedException`.
AWS KMS evaluation logic requires checks on both the key policy and IAM policies.
2
Review the evaluation logic for AWS KMS customer managed keys.
Unlike other AWS services where IAM policies alone can grant access, KMS requires the key policy to explicitly delegate permission to the AWS account (via the root principal ARN) or directly to the IAM role.
If the key policy does not delegate permission to the AWS account, any permissions granted in IAM policies are ignored.
3
Identify the correct resolution.
Add a statement in the KMS key policy that allows the root principal of the AWS account to perform actions, thereby enabling IAM policies to govern access to the key.
This establishes the delegation chain from the key policy to IAM policies.

Key Concept

AWS KMS Key Policies and IAM Policy Integration
Rate this question

Topics

AWS KMS and Encryption

More questions from this topic