Examkin

Question

Difficulty: MediumAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator is configuring an Amazon SQS queue in AWS account `111122223333` to use server-side encryption with a customer managed KMS key. An application running on an Amazon EC2 instance in the same account must send messages to the queue. The administrator has attached an IAM policy to the EC2 instance profile's IAM role that grants `sqs:SendMessage`, `kms:GenerateDataKey`, and `kms:Decrypt` permissions. However, the application logs show an Access Denied error when attempting to send messages to the queue.

The customer managed KMS key's key policy is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:user/SecurityAdmin"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

Which modification must the administrator make to resolve this access issue?

  1. A
    Modify the resource element of the IAM policy attached to the EC2 instance profile's IAM role from the KMS key ARN to a wildcard (`*`) to bypass the key policy restrictions.
  2. Add a statement to the KMS key policy that grants the AWS account root principal (`arn:aws:iam::111122223333:root`) access to the key, thereby enabling the IAM policy attached to the EC2 instance profile's role to take effect.Answer
  3. C
    Update the SQS queue policy to grant the necessary `kms:GenerateDataKey` and `kms:Decrypt` permissions to the EC2 instance profile's IAM role.
  4. D
    Attach a resource-based policy to the EC2 instance that explicitly allows the instance profile's IAM role to perform the required KMS actions.

Answer

Add a statement to the KMS key policy that grants the AWS account root principal (`arn:aws:iam::111122223333:root`) access to the key, thereby enabling the IAM policy attached to the EC2 instance profile's role to take effect.
To allow IAM policies to grant access to a customer managed KMS key, the key policy must explicitly delegate authorization to the account. This is accomplished by adding a statement to the key policy that grants the AWS account root principal (`arn:aws:iam::111122223333:root`) access to the key. Once this delegation is in place, the IAM policy attached to the EC2 instance profile's role can successfully grant the application permission to use the KMS key for encryption and decryption.

Step-by-Step Solution

1
Inspect the customer managed KMS key policy to check for IAM delegation.
Identify that the key policy only grants access to `arn:aws:iam::111122223333:user/SecurityAdmin` and lacks a statement delegating permissions to the root principal (`arn:aws:iam::111122223333:root`).
By default, customer managed KMS keys are only accessible via their key policy unless IAM delegation is enabled.
2
Determine the correct way to allow IAM policies to authorize KMS actions on the key.
Conclude that adding a statement to the key policy that allows the root principal (`arn:aws:iam::111122223333:root`) to perform KMS actions is required.
This enables the KMS service to evaluate the IAM policy attached to the EC2 instance profile's role when evaluating the request.

Key Concept

KMS Key Policy Delegation to IAM Policies
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic