Examkin

Question

Difficulty: MediumAWS Config Rules and Conformance Packs

A SysOps Administrator is deploying a conformance pack containing an AWS Config rule to evaluate EBS volume encryption. The administrator configures automatic remediation for the rule using an AWS Systems Manager (SSM) Automation document. The remediation is configured to encrypt non-compliant volumes using a customer managed key (CMK) in AWS Key Management Service (AWS KMS).

Although the administrator has attached an IAM policy to the SSM Automation service role that allows all KMS actions (kms:*), the automatic remediation fails. The execution history indicates a 'KMS Access Denied' error.

Which of the following explains the cause of this issue?

  1. A
    The SysOps Administrator's IAM user policy lacks the iam:PassRole permission for the SSM Automation service role.
  2. B
    The SysOps Administrator failed to configure an Amazon EventBridge rule to route the AWS Config compliance status change to the Systems Manager Automation service.
  3. The key policy of the customer managed key does not explicitly permit the SSM Automation service role to perform the required KMS operations.Answer
  4. D
    The IAM service-linked role for AWS Config (AWSServiceRoleForConfig) lacks the kms:GenerateDataKey and kms:Decrypt permissions for the KMS key.

Answer

The key policy of the customer managed key does not explicitly permit the SSM Automation service role to perform the required KMS operations.
For customer managed KMS keys, key policies are the primary mechanism for access control. If a key policy does not explicitly permit an IAM principal (in this case, the SSM Automation service role), or does not delegate permission to the AWS account to use IAM policies for access control, the principal will be denied access regardless of its attached IAM policies.

Step-by-Step Solution

1
Identify the service executing the remediation.
The remediation is executed by Systems Manager Automation using the SSM service role, not by the AWS Config service itself.
This determines which principal needs permissions for the KMS key.
2
Analyze KMS evaluation logic for customer managed keys.
Access to a customer managed key requires permission to be granted in the key policy. An IAM policy on the principal is not sufficient if the key policy does not delegate permissions to the account or explicitly trust the principal.
To resolve KMS Access Denied errors for service roles using customer managed keys, the key policy must be updated.

Key Concept

AWS Config automatic remediation executes Systems Manager Automation documents. When encrypting resources using AWS KMS customer managed keys during remediation, the key policy must explicitly grant the SSM service role access to the key.
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic