Examkin

Question

Difficulty: MediumAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator is configuring an Amazon Simple Notification Service (Amazon SNS) topic in AWS account 123456789012. The topic is encrypted using a customer managed AWS KMS key.

A monitoring application running on an Amazon EC2 instance in the same account must publish alerts to this SNS topic. The EC2 instance is associated with an IAM role named MonitoringAppRole that has an attached policy allowing the sns:Publish action.

Currently, the application fails to publish alerts, receiving an access denied error. The KMS key has the following key policy:

{
"Version": "2012-10-17",
"Id": "key-policy-1",
"Statement": [
{
"Sid": "Allow key administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/SysOpsAdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
}
]
}

The administrator wants to manage permissions for the KMS key using the IAM role's policy.

Which combination of actions must the SysOps Administrator perform to resolve this issue? (Select TWO.)

  1. Modify the KMS key policy to add a statement that grants the AWS account root principal (arn:aws:iam::123456789012:root) the kms:* permissions.Answer
  2. Update the IAM policy attached to MonitoringAppRole to allow the kms:GenerateDataKey and kms:Decrypt actions on the KMS key.Answer
  3. C
    Modify the KMS key policy to grant the SNS service principal (sns.amazonaws.com) the kms:GenerateDataKey and kms:Decrypt permissions.
  4. D
    Update the IAM policy attached to MonitoringAppRole to allow the kms:Encrypt and kms:Decrypt actions on the SNS topic ARN.
  5. E
    Update the SNS topic access policy to grant the MonitoringAppRole the kms:GenerateDataKey and kms:Decrypt permissions.

Answer

Modify the KMS key policy to grant the AWS account root principal (arn:aws:iam::123456789012:root) the kms:* permissions, and update the IAM policy attached to MonitoringAppRole to allow the kms:GenerateDataKey and kms:Decrypt actions on the KMS key.
To resolve the Access Denied error, the SysOps Administrator must first enable IAM-based policy delegation for the customer managed KMS key. The current KMS key policy does not delegate permissions to the AWS account root principal, which prevents IAM policies from granting access to the key. Adding a statement to the KMS key policy that allows the root principal (arn:aws:iam::123456789012:root) to perform kms:* actions enables IAM policies to control access to the key. Second, the administrator must modify the IAM role's policy to grant kms:GenerateDataKey and kms:Decrypt permissions on the KMS key. Both actions are required to successfully publish messages to the encrypted SNS topic.

Step-by-Step Solution

1
Analyze the current KMS key policy to identify why the attached IAM policy permissions are not taking effect.
Determine that the KMS key policy is missing the default statement delegating permissions to the root principal (arn:aws:iam::123456789012:root), which means identity-based IAM policies are ignored for this key.
KMS key policies are the primary authority, and IAM policies can only grant key access if the key policy explicitly delegates that authority to the account's root principal.
2
Modify the KMS key policy to enable IAM policy delegation.
A statement is added allowing the root principal (arn:aws:iam::123456789012:root) to perform kms:* actions.
This delegates key permission management to IAM policies, allowing the administrator to define permissions on individual IAM roles.
3
Update the EC2 instance's IAM role (MonitoringAppRole) policy with the required KMS permissions.
The IAM policy is updated to grant kms:GenerateDataKey and kms:Decrypt permissions on the KMS key ARN.
These actions are required by the publishing client to encrypt payloads before sending them to the SNS topic.

Key Concept

AWS KMS Key Policy Precedence and Delegation
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic