Examkin

Question

Difficulty: HardResolving IAM and Authorization Failures

A developer is configuring an AWS Lambda function to process events from an Amazon SQS queue. The queue is encrypted using an AWS Key Management Service (AWS KMS) customer managed key. The Lambda function's execution role has the following IAM policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes"
],
"Resource": "arn:aws:sqs:us-east-1:123456789012:QueueA"
}
]
}

The KMS customer managed key has the following key policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Allow administration of the key",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:user/KeyManager"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

When the Lambda event source mapping attempts to poll the queue, the function is not triggered, and CloudWatch logs indicate that the Lambda service is unauthorized to decrypt the SQS messages.

Which of the following modifications is required to resolve this authorization failure?

  1. A
    Modify the trust policy of the AWS KMS key to list the Lambda service principal lambda.amazonaws.com as a trusted entity allowed to assume the KMS key.
  2. Add kms:Decrypt permissions targeting the KMS key to the Lambda execution role's policy, and update the KMS key policy to allow the Lambda execution role to perform kms:Decrypt operations.Answer
  3. C
    Initialize the AWS SDK client inside the Lambda function by hardcoding the AWS access credentials of the KeyManager IAM user to decrypt the SQS message payload.
  4. D
    Configure an Amazon Cognito Identity Pool to authenticate the Lambda function, and attach a policy allowing the Cognito authenticated role to perform kms:Decrypt on the KMS key.

Answer

Add kms:Decrypt permissions targeting the KMS key to the Lambda execution role's policy, and update the KMS key policy to allow the Lambda execution role to perform kms:Decrypt operations.
The correct action is to add the kms:Decrypt permission to both the Lambda execution role and the KMS key policy. This is because AWS KMS customer managed keys require explicit authorization in the key policy itself if they do not delegate permission management to the account root principal. Without the key policy explicitly permitting the Lambda execution role, and the execution role explicitly permitting the action, the decryption request will fail.

Step-by-Step Solution

1
Analyze the IAM execution role of the Lambda function and notice it lacks kms:Decrypt permissions on the customer managed key used to encrypt the SQS queue.
Identify that the Lambda function execution role cannot decrypt the messages fetched from SQS.
AWS SQS queues encrypted with customer managed keys require KMS decrypt permissions for the consumer principal.
2
Analyze the customer managed KMS key policy and notice it only grants administrative permissions to a specific user, without delegating authorization to the account root or the Lambda execution role.
Identify that adding kms:Decrypt only to the IAM role is insufficient; the key policy must also explicitly allow it.
KMS key policies are the primary authorization mechanism for KMS keys and must explicitly allow the caller unless delegation to the account root is configured.
3
Update both the Lambda execution role policy and the KMS key policy to permit the kms:Decrypt operation.
The Lambda event source mapping successfully decrypts SQS payloads and triggers the Lambda function.
Providing permissions at both the IAM identity layer and the KMS key resource layer satisfies AWS evaluation logic for customer managed KMS keys.

Key Concept

AWS KMS evaluation logic requires that customer managed keys explicitly grant permissions to the IAM caller in the key policy, in addition to permissions in the identity-based policy.
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic