Examkin

Question

Difficulty: HardAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator is troubleshooting an access issue where an application running on an Amazon EC2 instance cannot decrypt data using an AWS KMS Customer Managed Key (CMK). The application uses an IAM role named AppExecutionRole. An IAM policy attached to this role allows the kms:Decrypt action on the CMK's Amazon Resource Name (ARN). However, the application continues to receive an AccessDenied error.

The CMK is configured with the following key policy:

{
"Version": "2012-10-17",
"Id": "key-policy-1",
"Statement": [
{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/AdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
}
]
}

Which of the following actions can the administrator take to resolve this issue? (Select TWO.)

  1. Add a statement to the KMS key policy that grants the account's root user (arn:aws:iam::111122223333:root) permissions to perform kms:Decrypt and kms:DescribeKey actions.Answer
  2. Modify the KMS key policy to add a statement that explicitly grants the AppExecutionRole principal permissions to perform kms:Decrypt and kms:DescribeKey actions.Answer
  3. C
    Attach an inline IAM policy to the AppExecutionRole that grants kms:Decrypt permissions on all resources (Resource: *).
  4. D
    Modify the trust policy of the AppExecutionRole to trust the KMS service principal (kms.amazonaws.com).
  5. E
    Create a Service Control Policy (SCP) in AWS Organizations that explicitly allows the kms:Decrypt action for the AppExecutionRole.

Answer

The administrator can resolve the issue by either adding a key policy statement that grants permissions to the account's root user (enabling IAM policy delegation) or explicitly granting the decryption permissions to the application role directly in the KMS key policy.
For Customer Managed Keys, access control is governed by the key policy. To allow a principal in the same account to use the key, the key policy must either explicitly grant the permission to that principal, or it must delegate permission management to IAM by granting the account's root principal (arn:aws:iam::111122223333:root) key permissions.

Step-by-Step Solution

1
Inspect the existing KMS key policy configuration.
The current KMS key policy only grants administrative rights to the AdminRole and does not delegate access to the account's IAM policies, nor does it explicitly authorize the application's role.
By default, Customer Managed Keys require explicit configuration in their key policy to allow usage; IAM policies alone cannot grant access without the key policy delegating authority.
2
Evaluate key policy delegation or direct authorization.
Authorizing the account's root principal in the key policy activates the attached IAM policy on the role. Alternatively, granting permissions directly to the role's principal in the key policy resolves the access restriction.
These represent the two valid access control paths for KMS key usage within the same AWS account.

Key Concept

KMS Key Policy Authorization and IAM Delegation
Rate this question

Topics

AWS Key Management Service (KMS) and Data Encryption

More questions from this topic