Examkin

Question

Difficulty: MediumAWS Key Management Service (KMS) and Data Encryption

A company has an AWS Lambda function that needs to decrypt data using a customer managed KMS key in the same AWS account. A SysOps Administrator has attached an IAM policy to the Lambda execution role that allows the `kms:Decrypt` action on the KMS key. However, when the Lambda function runs, it fails with an `AccessDeniedException` error during the decryption operation. The customer managed KMS key policy contains only the following statement:

{
"Version": "2012-10-17",
"Id": "key-policy-1",
"Statement": [
{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/AdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
"
}
]
}

Which modification to the configuration will resolve this error?

  1. Modify the KMS key policy to include a statement that grants the root account principal (`arn:aws:iam::123456789012:root`) permissions for KMS actions, thereby enabling the Lambda execution role's IAM policy to take effect.Answer
  2. B
    Configure the Lambda execution role's IAM trust policy to trust the KMS service principal (`kms.amazonaws.com`) and add `kms:Decrypt` to the role's identity-based policy.
  3. C
    Modify the IAM policy attached to the Lambda execution role to grant the role explicit permissions to update the key policy of the KMS key.
  4. D
    Attach a resource-based policy to the Lambda function that grants the KMS key permission to invoke the function with decryption actions.

Answer

Modify the KMS key policy to include a statement that grants the root account principal permissions for KMS actions, enabling the Lambda execution role's IAM policy to take effect.
The correct answer explains that the key policy must grant the root account principal access to the key. In AWS KMS, a customer managed key policy must explicitly delegate authorization control to the AWS account to make identity-based IAM policies effective. Adding this statement allows the Lambda execution role's IAM policy to grant the decryption permission.

Step-by-Step Solution

1
Analyze the customer managed key policy and the identity-based IAM policy on the execution role.
The Lambda function's execution role has an IAM policy allowing `kms:Decrypt`, but the KMS key policy lacks a statement enabling IAM delegation (specifically, a statement permitting the root principal of the account `arn:aws:iam::123456789012:root`).
Identify the cause of the authorization failure by checking the KMS evaluation order, which requires the key policy to explicitly authorize the caller or delegate authorization to the AWS account.
2
Determine the necessary change in the KMS key policy to enable IAM policy authorization.
Adding a statement to the customer managed key policy that grants the root principal (`arn:aws:iam::<AccountID>:root`) access to the key will allow IAM policies in the same account to grant KMS permissions.
Without this root delegation statement, any identity-based IAM policy trying to grant permissions to the customer managed key will be ignored.
3
Select the correct option that specifies root delegation in the key policy.
The option describing the addition of a statement to grant the root principal access is selected.
This configuration enables the Lambda execution role's identity-based policy to successfully authorize the decryption action.

Key Concept

By default, customer managed KMS keys are governed strictly by their key policies. To allow identity-based IAM policies in the same account to grant access to the key, the key policy must contain a statement that grants the account's root principal (`arn:aws:iam::<account-id>:root`) permission to perform KMS actions. If this root delegation statement is missing, all identity-based policies granting access to that key will be ignored, resulting in an AccessDeniedException.
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic