Examkin

Question

Difficulty: MediumAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator is configuring a customer managed KMS key to encrypt an Amazon S3 bucket in the same AWS account. An IAM user named DataAuditor needs to decrypt objects in this bucket. The administrator has attached an IAM policy to the DataAuditor user that allows kms:Decrypt on the KMS key's ARN. However, the user still receives an Access Denied error when trying to download and decrypt the objects. The current KMS key policy has been modified and does not contain the default statement that enables IAM policies.

Which of the following actions will resolve this issue? (Select TWO.)

  1. Modify the KMS key policy to explicitly grant the kms:Decrypt permission to the DataAuditor IAM user.Answer
  2. Add a statement to the KMS key policy that grants the AWS account root principal (arn:aws:iam::111122223333:root) permissions to perform all KMS actions.Answer
  3. C
    Add a statement to the S3 bucket policy that permits kms:Decrypt for the DataAuditor IAM user.
  4. D
    Enable automatic key rotation for the KMS key to automatically update the key policy permissions.
  5. E
    Configure a KMS grant that allows the S3 service principal (s3.amazonaws.com) to delegate decrypt permissions to the DataAuditor user.

Answer

Modify the KMS key policy to explicitly grant the kms:Decrypt permission to the DataAuditor IAM user, or add a statement to the KMS key policy that grants the AWS account root principal permissions to perform all KMS actions.
For customer managed KMS keys, the key policy is the primary controller of access. If the default statement delegating permissions to the account root principal is missing, IAM policies alone cannot grant access. To resolve this, you must either modify the KMS key policy to directly grant the user kms:Decrypt permissions, or add a statement to the KMS key policy that grants the AWS account root principal permissions, which enables the user's IAM policy to take effect.

Step-by-Step Solution

1
Analyze KMS evaluation logic.
Confirm that KMS key policies are the primary authenticator. Without delegation to the account root principal, IAM policies targeting the KMS key will be ignored.
This identifies why the user's current IAM policy is not sufficient to grant access.
2
Select resolution methods.
Determine that either the key policy must explicitly authorize the user, or it must delegate authority back to IAM policies by authorizing the account's root user.
These are the two standard paths to grant key usage permissions in AWS KMS.

Key Concept

AWS KMS evaluation logic requires either explicit key policy permission or delegation to IAM policies via the account root principal in the key policy.
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic