Examkin

Question

Difficulty: HardAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator is managing a multi-region application deployed on Amazon EC2 instances in both the `us-east-1` and `us-west-2` Regions. The application uses client-side encryption to protect configuration payloads before writing them to Amazon DynamoDB. To support this, the administrator created an AWS KMS Multi-Region primary customer managed key in `us-east-1` and replicated it to `us-west-2`.

The EC2 instances in `us-west-2` run under an IAM role with an IAM policy that allows `kms:Decrypt` on all resources (`"Resource": "*"`). However, when the application in `us-west-2` attempts to decrypt payloads that were encrypted in `us-east-1`, it receives an `AccessDeniedException` from AWS KMS.

Which of the following actions must the Administrator take to resolve this issue? (Select TWO.)

  1. Modify the key policy of the replica key in `us-west-2` to explicitly grant `kms:Decrypt` permissions to the EC2 instance IAM role.Answer
  2. Configure the application in `us-west-2` to target the regional AWS KMS endpoint in `us-west-2` and reference the replica key's ARN in `us-west-2`.Answer
  3. C
    Enable automatic synchronization of key policies in the primary key settings in `us-east-1` to replicate all changes to the replica key in `us-west-2`.
  4. D
    Enable the AWS-managed KMS key for DynamoDB (`aws/dynamodb`) in `us-west-2` to act as a fallback decryptor for ciphertext encrypted by the primary key.
  5. E
    Create an IAM role trust policy that allows the AWS KMS service principal to assume the EC2 instance IAM role.

Answer

Modify the key policy of the replica key in the target Region to grant decrypt permissions to the EC2 IAM role, and configure the application in that Region to use the local replica key ARN at the local regional KMS endpoint.
The correct options address the independent nature of AWS KMS Multi-Region key resources. The option directing the administrator to modify the key policy of the replica key in the local region is necessary because key policies are managed independently, and the default policy might not permit local IAM role access without explicit trust. The option to configure the application to target the regional AWS KMS endpoint using the replica key's ARN ensures the decryption operation happens locally and utilizes the authorized replica key, avoiding cross-region calls that may fail due to key policy restrictions on the primary key.

Step-by-Step Solution

1
Analyze the resource boundaries for AWS KMS Multi-Region keys.
Identify that while primary and replica keys share the same key ID and key material, they are separate AWS resources with distinct ARNs and independent key policies.
This determines that permission changes on the primary key policy do not automatically apply to the replica key policy.
2
Evaluate the key policy of the replica key in the target Region (`us-west-2`).
Update the replica key's policy to either explicitly trust the IAM role of the EC2 instances or allow IAM policy delegation from the root account.
AWS KMS requires that the key policy itself grants or delegates permission; IAM policies alone cannot grant access to a KMS key without key policy authorization.
3
Align the application's KMS API calls with the local Region.
Configure the application to make local decryption calls to the `us-west-2` KMS endpoint using the `us-west-2` replica key ARN.
This avoids cross-region network calls and resolves access issues related to the primary key's policy or regional endpoint connectivity.

Key Concept

AWS KMS Multi-Region keys share the same key material but are distinct resources with independent key policies that must be managed and authorized separately in each Region.
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic