Examkin

Question

Difficulty: MediumAWS Key Management Service (KMS) and Data Encryption

An application running on an Amazon EC2 instance in Account B (444455556666) needs to decrypt sensitive files stored in an Amazon S3 bucket in Account A (111122223333). The files in the S3 bucket are encrypted using Server-Side Encryption with AWS KMS (SSE-KMS) and a customer managed KMS key in Account A. The KMS key currently has the following key policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:root"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

An IAM role named AppRole is attached as the instance profile for the EC2 instance in Account B. Which TWO configurations are required to allow AppRole in Account B to decrypt the objects in the S3 bucket? (Select TWO.)

  1. Update the KMS key policy in Account A to allow the IAM role AppRole in Account B to perform the kms:Decrypt action.Answer
  2. Attach an IAM policy to the IAM role AppRole in Account B that allows the kms:Decrypt action on the KMS key ARN in Account A.Answer
  3. C
    Add the IAM role AppRole from Account B to the S3 bucket policy in Account A with an Allow effect for the kms:Decrypt action.
  4. D
    Rely on the existing KMS key policy in Account A to delegate access, and only attach an IAM policy to the IAM role AppRole in Account B that allows kms:Decrypt on the KMS key.
  5. E
    Enable S3 Bucket Keys on the S3 bucket in Account A to automatically delegate KMS decryption authority to Account B's IAM role.

Answer

To configure cross-account decryption, update the KMS key policy in Account A to grant permission to the external role, and attach an IAM policy to the role in Account B allowing decryption on the key ARN.
To establish cross-account access to a customer managed KMS key, permissions must be granted on both sides. The key policy of the KMS key in Account A must be configured to trust the external role (or Account B's root principal), and the IAM policy attached to the EC2 instance role in Account B must allow the kms:Decrypt action on the ARN of the KMS key in Account A. Together, these two configurations authorize the cross-account decryption request.

Step-by-Step Solution

1
Review the requirements for cross-account AWS KMS key access.
Identify that cross-account access requires permissions to be granted in both the KMS key policy of the owning account and the IAM policy of the calling account.
AWS KMS requires explicit authorization from both the key owner and the caller's account when requests cross AWS accounts.
2
Update the KMS key policy in Account A (the key owner).
Add a statement to the key policy that permits the external IAM role (arn:aws:iam::444455556666:role/AppRole) to perform the kms:Decrypt action.
The customer managed key policy must trust the external identity before Account B can delegate or use the key.
3
Attach an IAM policy to the EC2 instance role in Account B (the caller).
Add a policy allowing the kms:Decrypt action on the target key's ARN in Account A.
The caller's identity must be explicitly permitted by its own account's IAM policy to access the external key resource.

Key Concept

Cross-account AWS KMS access requires configuring both the KMS key policy in the source account to trust the destination principal, and an IAM policy in the destination account to permit the caller to use the external KMS key.
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic