Examkin

Question

Difficulty: MediumAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator is securing a customer managed KMS key in the us-west-2 Region that is used to encrypt Amazon Elastic Block Store (EBS) volumes. The administrator wants to enforce the following security requirements:
- Users in the AWS account must be able to administer the key (such as enabling rotation or updating policies) using IAM policies.
- The key must only be allowed to encrypt and decrypt EBS volumes when the request is made by Amazon EC2 on behalf of a user, preventing direct API calls using the AWS CLI or SDKs.

Which two actions must the administrator take to meet these requirements? (Select two.)

  1. Include a statement in the KMS key policy that grants `kms:*` permissions to the account's root principal (`arn:aws:iam::111122223333:root`).Answer
  2. Add a condition to the KMS key policy's cryptographic operations statement that specifies `"StringEquals": { "kms:ViaService": "ec2.us-west-2.amazonaws.com" }`.Answer
  3. C
    Add a condition to the KMS key policy's cryptographic operations statement that specifies `"StringEquals": { "kms:ViaService": "ebs.us-west-2.amazonaws.com" }`.
  4. D
    Configure the key policy's Principal to trust `ebs.amazonaws.com` and define a KMS Grant allowing EBS to delegate access to EC2.
  5. E
    Apply IAM policies directly to users granting admin access, as IAM policies take precedence over key policies by default.

Answer

The administrator must add a statement to the KMS key policy that grants `kms:*` permissions to the account's root principal (`arn:aws:iam::111122223333:root`) and add a condition to the KMS key policy's cryptographic operations statement specifying `"kms:ViaService": "ec2.us-west-2.amazonaws.com"`.
To allow IAM policies to manage the key, the KMS key policy must delegate administrative permissions to the root principal of the AWS account. Additionally, to restrict key usage to EBS volume operations while blocking direct API calls, the key policy must include a condition restricting requests to the EC2 service in the appropriate Region using the `kms:ViaService` condition key set to `ec2.us-west-2.amazonaws.com`.

Step-by-Step Solution

1
Enable IAM policy delegation in the KMS key policy.
Allows IAM policies attached to users and roles within the account to control access permissions for the KMS key.
By default, a KMS key is only manageable via its key policy unless it explicitly grants permissions to the account root principal.
2
Add the `kms:ViaService` condition to the key policy for cryptographic operations.
Restricts key usage to requests made by specified AWS services on behalf of the user.
This prevents users from performing direct decrypt/encrypt actions via the CLI/SDK, forcing the requests to go through EC2 when attaching the EBS volume.
3
Set the service principal to `ec2.us-west-2.amazonaws.com`.
Ensures the restriction correctly matches EBS operations in the us-west-2 Region.
EBS uses the EC2 service endpoint under the hood for volume attachment and encryption.

Key Concept

KMS key policies control authorization, and IAM policies can only manage a KMS key if the key policy explicitly delegates authority to the account root principal. The `kms:ViaService` condition key restricts KMS key usage to requests coming from specific AWS services.
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic