Examkin

Question

Difficulty: HardAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator in Account 111111111111111111111111 is troubleshooting a decryption error. An application running on an Amazon EC2 instance with the IAM role `AppExecutionRole` attached is attempting to decrypt a configuration file using a Customer Managed Key (CMK). The IAM policy attached to `AppExecutionRole` contains the following statement:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKmsDecrypt",
"Effect": "Allow",
"Action": "kms:Decrypt",
"Resource": "arn:aws:kms:us-east-1:111111111111:key/12345678-1234-1234-1234-123456789012"
}
]
}

However, the application receives a `KMS.AccessDeniedException` when calling the `Decrypt` API. The Administrator reviews the current KMS key policy for the CMK:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKeyAdmins",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111111111111:role/KmsAdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
}
]
}

Which changes will resolve the decryption error? (Select TWO.)

  1. Add a statement to the KMS key policy that grants the root account principal (`arn:aws:iam::111111111111:root`) permissions for `kms:*` to enable IAM policy delegation.Answer
  2. Add a statement to the KMS key policy that explicitly grants the `AppExecutionRole` principal (`arn:aws:iam::111111111111:role/AppExecutionRole`) permission to perform the `kms:Decrypt` action.Answer
  3. C
    Add the `AppExecutionRole` ARN to the existing `AllowKeyAdmins` statement in the KMS key policy.
  4. D
    Modify the IAM policy attached to `AppExecutionRole` to change the resource to the KMS key alias instead of the key ARN.
  5. E
    Modify the IAM policy attached to `AppExecutionRole` to include the `kms:DescribeKey` action, which allows the IAM permissions to override the key policy.

Answer

To resolve the decryption error, you must either add a statement to the KMS key policy that grants the root account principal (`arn:aws:iam::111111111111:root`) permissions for `kms:*` to enable IAM policy delegation, or add a statement to the KMS key policy that explicitly grants the `AppExecutionRole` principal (`arn:aws:iam::111111111111:role/AppExecutionRole`) permission to perform the `kms:Decrypt` action.
The KMS key policy is the primary authorization mechanism for KMS keys. To allow an IAM policy to grant access to a KMS key, the key policy must delegate that authority to the account. This is accomplished by adding a statement to the key policy that grants the account root principal (`arn:aws:iam::111111111111:root`) permissions to perform KMS actions (typically `kms:*`). Alternatively, the KMS key policy can directly grant permissions to the specific IAM principal (`arn:aws:iam::111111111111:role/AppExecutionRole`) for the `kms:Decrypt` action, bypassing the need for delegation.

Step-by-Step Solution

1
Analyze the IAM policy attached to the role to verify that the `kms:Decrypt` action is allowed on the correct KMS key ARN.
The IAM policy correctly specifies the `kms:Decrypt` action and targets the correct KMS key ARN.
This determines if the application's identity has been granted the necessary local permissions.
2
Examine the KMS key policy to check if access control is delegated to IAM policies or if the role has direct permissions.
The key policy only contains an administrative statement for `KmsAdminRole` and does not reference the root account principal (`arn:aws:iam::111111111111:root`) or the role principal directly.
KMS key policies are the primary authorization mechanism. Without a statement delegating control to the root account principal or directly listing the role, IAM policies targeting the key have no effect.
3
Identify the required changes to the KMS key policy to permit authorization.
Either add a statement delegating permissions to the root account principal so the existing IAM policy takes effect, or add a statement directly granting `kms:Decrypt` to the execution role in the key policy.
This establishes the missing trust and authorization chain in KMS for the decrypt operation.

Key Concept

KMS key policy precedence and IAM delegation
Estimated Time:2m 30s
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic