Examkin

Question

Difficulty: EasyAWS Key Management Service (KMS) and Data Encryption

An administrator is configuring access to an AWS Key Management Service (AWS KMS) customer managed key. The following KMS key policy is applied:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Allow direct admin access",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/AdminRole"
},
"Action": "kms:*",
"Resource": "*"
}
]
}

An operator in the same AWS account (111122223333) has an IAM policy attached to their user profile that grants full access to KMS (kms:*). However, the operator receives an Access Denied error when attempting to encrypt data using this key.

Which configuration change will allow the operator to use the KMS key?

  1. Add a statement to the KMS key policy that grants the account root principal (arn:aws:iam::111122223333:root) permission to perform the KMS actions.Answer
  2. B
    Attach an IAM policy with the iam:PassRole permission to the operator's user profile to allow passing the key.
  3. C
    Create a new IAM policy with an explicit allow statement, since IAM policies automatically override KMS key policies for resources in the same account.
  4. D
    Modify the network access control list (NACL) of the operator's subnet to allow outbound ephemeral ports to the KMS service endpoint.

Answer

Add a statement to the KMS key policy that grants the account root principal (arn:aws:iam::111122223333:root) permission to perform the KMS actions.
In AWS KMS, the key policy is the authoritative policy document for the key. To allow IAM policies in the same account to grant access to the KMS key, the key policy must contain a statement that grants the account root principal ('arn:aws:iam::111122223333:root') permissions to the key. Once this statement is in place, IAM policies can be used to control access.

Step-by-Step Solution

1
Analyze the KMS key policy to determine if IAM delegation is configured.
The key policy only grants access to the specific AdminRole, not the account root principal.
Without the account root principal statement in the KMS key policy, IAM policies attached to users or roles in the account cannot grant permission to use the key.
2
Identify the configuration change required to delegate access control to IAM.
The root principal (arn:aws:iam::111122223333:root) must be added to the KMS key policy's principal block with appropriate permissions.
This configuration allows the AWS KMS service to trust IAM policies in account 111122223333 to grant access to the key.

Key Concept

KMS Key Policy and IAM Policy Integration
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic