Examkin

Question

Difficulty: MediumAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator is configuring an AWS Lambda function in AWS Account 555555555555555555555555 to decrypt sensitive application configuration files. The configuration files are encrypted using a customer managed KMS key. The Administrator has attached an IAM policy to the Lambda function's execution role that grants permission for the `kms:Decrypt` action on the KMS key. However, when executing, the Lambda function fails with an AccessDeniedException during the decryption step.

Upon inspecting the KMS key policy, the Administrator finds only the following statement:

{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::555555555555:role/SysOpsAdminRole"
},
"Action": "kms:*",
"Resource": "*"
}

Which modification to the KMS key policy will resolve this issue by allowing the Lambda function's IAM policy to take effect?

  1. A
    Modify the KMS key policy to trust the KMS service principal (`kms.amazonaws.com`) under the Principal element.
  2. B
    Update the Principal in the key policy's existing statement to specify `*` and add a Condition block that restricts access to the Lambda execution role.
  3. Add a statement to the KMS key policy that grants the root user of account 555555555555555555555555 (`arn:aws:iam::555555555555:root`) permissions for all KMS actions (`kms:*`).Answer
  4. D
    Add a statement to the KMS key policy that explicitly denies the execution role any administrative actions, forcing evaluation to default to the IAM policy.

Answer

Add a statement to the KMS key policy that grants the root user of the account (`arn:aws:iam::555555555555:root`) permissions for all KMS actions (`kms:*`).
In AWS KMS, for IAM policies to grant access to a customer managed key, the key policy must contain a statement that delegates authority to the AWS account. This is typically done by granting the root user principal (`arn:aws:iam::account-id:root`) permission to perform actions on the key. Once this statement is present, AWS evaluates both the key policy and the IAM policies. Since the Lambda execution role already has an IAM policy allowing `kms:Decrypt`, adding the account root principal statement to the key policy resolves the AccessDeniedException.

Step-by-Step Solution

1
Analyze the existing configurations of the Lambda execution role and the KMS key policy.
The Lambda role contains a policy granting `kms:Decrypt`. However, the KMS key policy only lists a specific administrator role (`SysOpsAdminRole`) and does not grant the account root principal permission to manage permissions via IAM.
By default, KMS key policies must explicitly delegate permission authority to the AWS account for any IAM policies within that account to have effect on the key.
2
Identify the standard delegation statement required in KMS key policies.
The statement must target the AWS account root principal (`arn:aws:iam::555555555555:root`) and grant `kms:*` permissions.
This configuration establishes the link between the key policy and IAM policies, allowing AWS to evaluate IAM policies for roles or users attempting to access the key.
3
Select the option that implements this configuration.
Adding a statement to the key policy that permits the account root user enables evaluation of the Lambda function's execution role policy, resolving the AccessDeniedException.
Once the root user is added to the key policy, the Lambda execution role's policy is successfully evaluated, granting the necessary decryption permissions.

Key Concept

AWS KMS Key Policy Delegation to IAM
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic