Examkin

Question

Difficulty: HardAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator in Account AA (123456789012123456789012) is configuring an Amazon EC2 Auto Scaling group to launch instances from a shared Amazon Machine Image (AMI) owned by Account BB (987654321098987654321098). The AMI is backed by an Amazon Elastic Block Store (Amazon EBS) snapshot encrypted using a customer managed key (CMK) in Account BB. The Administrator must establish the necessary permissions so that the Auto Scaling group can decrypt the snapshot to launch the instances. Which combination of actions must the Administrator perform to meet these requirements? (Select TWO.)

  1. In Account BB, update the KMS key policy of the CMK to grant the administrator identity in Account AA permissions to perform the `kms:CreateGrant` and `kms:DescribeKey` operations.Answer
  2. In Account AA, create a KMS grant for the Auto Scaling service-linked role (`AWSServiceRoleForAutoScaling`) using the CMK Amazon Resource Name (ARN) from Account BB, specifying the operations `Decrypt`, `GenerateDataKeyWithoutPlaintext`, and `CreateGrant`.Answer
  3. C
    In Account AA, attach an IAM policy to the EC2 instance profile role that allows `kms:Decrypt` and `kms:GenerateDataKey` operations targeting the CMK in Account BB.
  4. D
    In Account BB, update the KMS key policy of the CMK to directly grant the Auto Scaling service-linked role in Account AA permissions to perform the `kms:Decrypt` and `kms:GenerateDataKeyWithoutPlaintext` operations.
  5. E
    In Account BB, re-encrypt the snapshot using the AWS-managed KMS key for Amazon EBS (`aws/ebs`) before sharing the AMI with Account AA.

Answer

To resolve this, the administrator must update the KMS key policy in the key-owning account to allow the consumer account to create grants, and then create a KMS grant in the consumer account for the Auto Scaling service-linked role with the required operations.
For an Auto Scaling group to launch instances using an encrypted AMI from another account, the KMS key policy in the sharing account must allow the consumer account to create grants. Then, the consumer account must use the CLI or SDK to create a grant for the Auto Scaling service-linked role (`AWSServiceRoleForAutoScaling`) with the `Decrypt`, `GenerateDataKeyWithoutPlaintext`, and `CreateGrant` operations. This allows the Auto Scaling service to delegate the decryption of the EBS snapshot to the Amazon EC2 service when provisioning the instances.

Step-by-Step Solution

1
In Account BB, modify the KMS key policy of the CMK to delegate grant creation permissions to Account AA.
Allows administrator users or roles in Account AA to call the `kms:CreateGrant` API operation on the key.
By default, cross-account IAM policies cannot grant access to a KMS key unless the key policy itself delegates permission management to the external account.
2
In Account AA, create a KMS grant for the Auto Scaling service-linked role pointing to the CMK in Account BB.
Allows the `AWSServiceRoleForAutoScaling` role to perform `Decrypt`, `GenerateDataKeyWithoutPlaintext`, and `CreateGrant` operations.
Auto Scaling requires a grant because it uses a service-linked role to perform operations asynchronously on behalf of the customer, including delegating decryption rights to the Amazon EC2 service during instance launch.

Key Concept

Cross-account Amazon EBS encryption with Amazon EC2 Auto Scaling requires delegating KMS permissions via key policies and creating KMS grants for the service-linked role in the consumer account.
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic