Examkin

Question

Difficulty: MediumSecrets and Parameters Management

An application running on Amazon EC2 instances in a private subnet needs to retrieve database credentials stored as a SecureString parameter in AWS Systems Manager Parameter Store. The parameter is encrypted with an AWS KMS customer managed key (CMK). The SysOps administrator has attached an IAM policy to the EC2 instance profile's IAM role that allows both ssm:GetParameter and kms:Decrypt on the respective resource ARNs. However, when the application runs, it fails to retrieve the parameter and receives an AccessDeniedException from AWS KMS. Which action will resolve this issue?

  1. A
    Add the iam:PassRole permission to the EC2 instance profile's IAM role, specifying the AWS KMS key ARN as the resource.
  2. Update the KMS key policy of the customer managed key to allow the EC2 instance profile's IAM role to perform the kms:Decrypt action.Answer
  3. C
    Configure a gateway VPC endpoint for AWS KMS and associate it with the route table of the private subnet.
  4. D
    Change the parameter tier from Standard to Advanced to enable cross-service AWS KMS decryption delegation.

Answer

Update the KMS key policy of the customer managed key to allow the EC2 instance profile's IAM role to perform the kms:Decrypt action.
The correct action is to update the key policy of the KMS customer managed key (CMK). Unlike AWS managed keys (where permissions are managed automatically), customer managed keys require their key policy to explicitly authorize the caller or authorize the account to use IAM policies for permission delegation. Without this authorization in the key policy, the EC2 instance's IAM role will receive an AccessDeniedException despite having the correct IAM policy.

Step-by-Step Solution

1
Analyze the error response.
The application receives an AccessDeniedException from AWS KMS, indicating that network routing is functional, but KMS has denied authorization to decrypt.
This rules out network-related issues, such as VPC endpoint configuration or route table mismatches.
2
Evaluate KMS policy precedence.
KMS key policies control access to customer managed keys. An IAM policy alone cannot grant access to a customer managed key unless the key policy itself explicitly delegates permission to the root account or lists the IAM role as an authorized user.
KMS key policies take precedence over IAM policies for customer managed keys.
3
Update the key policy.
Modify the KMS key policy to include the EC2 instance profile's IAM role ARN in the list of principals allowed to perform the kms:Decrypt action.
This establishes the necessary trust in the key policy to allow the IAM role to use the key for decryption.

Key Concept

KMS Key Policy Precedence
Estimated Time:1m 30s
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic