Examkin

Question

Difficulty: MediumAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator is configuring cross-account access to a customer managed KMS key in Account A (123456789012123456789012) to allow an application running on an IAM role in Account B (987654321098987654321098) to decrypt data.

Currently, the KMS key policy in Account A contains the following default statement:

{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "kms:*",
"Resource": "*"
}

Which combination of actions must the SysOps Administrator perform to grant the application in Account B access to the KMS key? (Select TWO.)

  1. In Account A, modify the customer managed KMS key policy to grant the Account B AWS account root principal (`arn:aws:iam::987654321098:root`) permission to perform the `kms:Decrypt` action.Answer
  2. In Account B, attach an IAM policy to the application's IAM role that allows the `kms:Decrypt` action on the KMS key ARN in Account A.Answer
  3. C
    In Account A, attach an IAM policy to the administrator role that allows Account B's IAM role to access the KMS key directly.
  4. D
    In Account B, update the default AWS-managed KMS key policy (`aws/s3`) to delegate KMS permissions to the application's IAM role.
  5. E
    In Account B, configure a resource-based policy on the application's IAM role that trusts the KMS key in Account A.

Answer

In Account A, modify the customer managed KMS key policy to grant the Account B AWS account root principal permission to perform the `kms:Decrypt` action; and in Account B, attach an IAM policy to the application's IAM role that allows the `kms:Decrypt` action on the KMS key ARN in Account A.
For cross-account access to a customer managed AWS KMS key, both accounts must grant permissions. The owning account (Account A) must update the KMS key policy to trust the consuming account (Account B) root principal or the specific IAM role. The consuming account (Account B) must then grant permission to the IAM role via an identity-based IAM policy targeting the KMS key's Amazon Resource Name (ARN).

Step-by-Step Solution

1
Modify the key policy in the key-owning account (Account A) to trust the external account's root principal (`arn:aws:iam::987654321098:root`) or the specific IAM role.
This establishes the trust relationship from the resource owner side, enabling delegation.
By default, KMS key policies restrict access to the host account. Cross-account access requires explicit resource-level permission in the key policy.
2
Attach an identity-based IAM policy to the IAM role in Account B allowing `kms:Decrypt` on the specific key ARN in Account A.
This grants the application's role the client-side permission to call the external KMS key.
Even if the key policy trusts Account B, the target IAM role in Account B must be explicitly permitted to perform the action in its own identity policy.

Key Concept

AWS KMS cross-account access requires authorization from both the resource-based key policy in the owning account and the identity-based IAM policy in the consuming account.
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic