Examkin

Question

Difficulty: HardAWS Key Management Service (KMS) and Data Encryption

An application running on an Amazon EC2 instance in Account A (111122223333) uses an IAM role named AppReaderRole. The application needs to read and decrypt files stored in an Amazon S3 bucket in Account B (444455556666). The S3 bucket is configured with server-side encryption using a customer managed key (CMK) in Account B. The AppReaderRole in Account A has been granted s3:GetObject on the S3 bucket and kms:Decrypt on the CMK via its local IAM policy. The S3 bucket policy in Account B allows s3:GetObject to the AppReaderRole. However, when the application attempts to download an encrypted file, it receives an AccessDenied error from KMS. The KMS key policy in Account B contains only the default statement that allows all actions to Account B's root principal. Which action should the SysOps Administrator take to resolve this issue?

  1. Modify the KMS key policy in Account B to allow the AppReaderRole in Account A (or the Account A root principal) to perform the kms:Decrypt action.Answer
  2. B
    Modify the S3 bucket policy in Account B to grant kms:Decrypt permissions on the customer managed key to the AppReaderRole in Account A.
  3. C
    Change the S3 bucket encryption to use the default AWS managed key (aws/s3) for SSE-KMS, and rely on the existing IAM policy in Account A for decryption.
  4. D
    Attach an IAM policy to the EC2 instance's IAM role in Account A that allows it to assume a custom key administration role in Account B.

Answer

Modify the KMS key policy in Account B to allow the AppReaderRole in Account A (or the Account A root principal) to perform the kms:Decrypt action.
For cross-account access to resources encrypted with a Customer Managed KMS key (CMK), the key policy in the owning account must explicitly grant permission to the external account (either the external root account to delegate via IAM, or directly to the external IAM role). Additionally, the IAM policy in the consuming account must also allow the action. Since the IAM role in Account A already has the necessary IAM permissions, modifying the KMS key policy in Account B to trust the role or Account A's root will complete the trust path and resolve the AccessDenied error.

Step-by-Step Solution

1
Identify that the resource is encrypted using a Customer Managed KMS key in a different account (Account B).
Realize that standard cross-account IAM delegation rules apply to the KMS key.
To decrypt the object, both Account A's IAM policy and Account B's KMS key policy must permit the operation.
2
Examine the KMS key policy in Account B.
Determine that it only permits access to local root/IAM users in Account B.
Since KMS key policies do not automatically trust external accounts, Account B's key policy is currently blocking Account A's AppReaderRole.
3
Modify the KMS key policy in Account B to grant access to the external identity.
Add a statement allowing Account A's root principal (allowing Account A's IAM to delegate) or directly allowing the AppReaderRole ARN.
This establishes the necessary trust relationship to permit the cross-account decryption request.

Key Concept

Cross-account KMS key access delegation using KMS key policies and IAM policies.
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic