Examkin

Question

Difficulty: Very hardAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator in Account A (111111111111111111111111) needs to share an encrypted Amazon EBS snapshot with Account B (222222222222222222222222). The snapshot is encrypted with a customer managed KMS key in Account A (Key-A). The administrator has successfully shared the snapshot with Account B. In Account B, an IAM user named `CopyAdmin` attempts to copy the shared snapshot to Account B and encrypt the copy using a customer managed KMS key in Account B (Key-B). However, the copy operation fails with a KMS Access Denied error.

Which of the following configurations are required to successfully complete the snapshot copy operation? (Select TWO.)

  1. In Account A, modify the key policy of Key-A to grant Account B (or the CopyAdmin user) the kms:DescribeKey, kms:Decrypt, and kms:CreateGrant permissions.Answer
  2. In Account B, attach an IAM policy to the CopyAdmin user that grants the kms:DescribeKey, kms:Decrypt, and kms:CreateGrant permissions targeting the ARN of Key-A.Answer
  3. C
    In Account B, attach an IAM policy to the CopyAdmin user that grants the kms:Decrypt and kms:CreateGrant permissions targeting Key-A, without modifying the key policy of Key-A in Account A.
  4. D
    In Account A, modify the key policy of Key-A to grant the Amazon EC2 service principal (ec2.amazonaws.com) direct kms:Decrypt and kms:GenerateDataKey* permissions.
  5. E
    In Account A, modify the key policy of Key-A to grant Account B permissions for kms:Encrypt and kms:ReEncryptTo only.

Answer

In Account A, modify the key policy of Key-A to grant Account B (or the CopyAdmin user) the kms:DescribeKey, kms:Decrypt, and kms:CreateGrant permissions; and in Account B, attach an IAM policy to the CopyAdmin user that grants the kms:DescribeKey, kms:Decrypt, and kms:CreateGrant permissions targeting the ARN of Key-A.
To successfully copy an encrypted EBS snapshot across AWS accounts, permissions must be explicitly allowed on both sides of the account boundary. First, the key policy of the customer managed key in the source account (Key-A in Account A) must trust the destination account or principal, granting permissions to describe the key, decrypt the data, and create a KMS grant. The kms:CreateGrant permission is essential because the EBS service uses grants to access the KMS key during the copy operation. Second, the copying IAM principal in the destination account (CopyAdmin in Account B) must have an attached IAM policy that permits those same actions on the external key's ARN. Without both configurations, the cross-account copy operation will fail.

Step-by-Step Solution

1
Configure the key policy in the resource-owning account (Account A)
The key policy for Key-A allows Account B (or the CopyAdmin user) to perform kms:DescribeKey, kms:Decrypt, and kms:CreateGrant.
Since the key belongs to Account A, Account A must trust Account B. The kms:CreateGrant permission is required because the Amazon EBS service in Account B will perform the actual decryption asynchronously on behalf of the user using a KMS grant.
2
Configure the IAM policy in the consuming account (Account B)
The CopyAdmin user in Account B is authorized by their local IAM policy to access Key-A in Account A using the specified KMS actions.
For cross-account operations, access must be allowed both by the resource policy in the source account and by the identity policy in the destination account. One-sided configuration results in an Access Denied error.

Key Concept

Cross-account KMS key access requirements and service delegation via grants for EBS snapshot copies
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic