Examkin

Question

Difficulty: MediumAWS Key Management Service (KMS) and Data Encryption

An application running on an IAM role in Account A (999988887777) needs to read messages from an encrypted Amazon SQS queue in Account B (555544443333). The queue is encrypted using a customer managed KMS key in Account B. The administrator has attached the following IAM policy to the role in Account A:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSQSandKMS",
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"kms:Decrypt"
],
"Resource": [
"arn:aws:sqs:us-east-1:555544443333:TargetQueue",
"arn:aws:kms:us-east-1:555544443333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
]
}
]
}

The SQS queue policy in Account B allows the IAM role in Account A to perform SQS actions. The KMS key policy in Account B contains the following default statement:

{
"Version": "2012-10-17",
"Id": "key-default-1",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::555544443333:root"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

When the application in Account A attempts to read messages from the queue, it fails with a KMS access denied error. What must the administrator do to resolve this issue?

  1. A
    Modify the SQS queue policy in Account B to include the kms:Decrypt permission on the KMS key for the IAM role in Account A.
  2. B
    Create a new IAM policy in Account B that grants the IAM role in Account A permissions to decrypt using the KMS key.
  3. Modify the KMS key policy in Account B to explicitly allow the IAM role in Account A to perform the kms:Decrypt action.Answer
  4. D
    Rely on the existing configuration, as the default key policy statement delegates all decryption permissions to the IAM policies of any trusting account.

Answer

Modify the KMS key policy in Account B to explicitly allow the IAM role in Account A to perform the kms:Decrypt action.
For cross-account access to a customer managed KMS key, permissions must be granted on both sides: the external account's IAM policy and the owning account's KMS key policy. The default key policy statement ('Enable IAM User Permissions') only delegates authorization power to IAM policies within the same account (Account B). Therefore, to allow the IAM role in Account A to decrypt using the key, the key policy in Account B must be modified to explicitly grant the role permission to perform the kms:Decrypt action.

Step-by-Step Solution

1
Determine the decryption requirements for reading messages from an encrypted SQS queue.
The caller (IAM role in Account A) needs sqs:ReceiveMessage on the SQS queue and kms:Decrypt on the KMS key used to encrypt the queue.
Since the SQS queue is encrypted using server-side encryption (SSE-KMS) with a customer managed key, callers must possess decryption rights on that key to retrieve the plaintext message payload.
2
Examine the default KMS key policy's delegation boundary in Account B.
The default key policy statement only delegates authorization capabilities to IAM policies within Account B.
The statement referencing the root user of Account B enables IAM policies within Account B to define access to the key. It does not grant authorization capabilities to IAM policies defined in Account A.
3
Apply cross-account access control rules for KMS.
Modify the customer managed KMS key policy in Account B to explicitly grant kms:Decrypt permissions to the Account A IAM role.
For cross-account KMS access, the trust must be established on both sides: the caller's IAM policy must allow the action, and the KMS key policy in the owning account must explicitly grant permission to the external identity.

Key Concept

Cross-account KMS key access and key policy precedence
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic