Examkin

Question

Difficulty: MediumSecrets and Parameters Management

An application runs on an Amazon EC2 instance that retrieves its database credentials at startup from AWS Systems Manager Parameter Store. The credentials are encrypted as a SecureString parameter using a custom AWS KMS customer managed key. Although the instance's IAM role has a policy allowing both ssm:GetParameter and kms:Decrypt actions, the application logs show an AccessDeniedException when trying to retrieve the parameter. Which of the following is the most likely cause of this issue?

  1. The KMS key policy associated with the custom key does not grant the EC2 instance's IAM role permission to perform the kms:Decrypt action.Answer
  2. B
    The EC2 instance's IAM role is missing the iam:PassRole permission to delegate authority to the Systems Manager service.
  3. C
    The automatic rotation configuration for the parameter has failed because the AWS Lambda rotation function failed to update the parameter's rotation metadata.
  4. D
    The EC2 instance is located in a public subnet, but the subnet's route table is missing a route pointing to the Internet Gateway to access the AWS KMS endpoint.

Answer

The KMS key policy associated with the custom key does not grant the EC2 instance's IAM role permission to perform the kms:Decrypt action.
For custom AWS KMS keys, access is evaluated by examining both the caller's IAM policies and the KMS key policy. Even if the EC2 instance role has an IAM policy allowing the decrypt operation, the request will be denied if the key policy does not explicitly permit the role or delegate permissions to the account.

Step-by-Step Solution

1
Identify the service and encryption method used for the credentials.
The credentials are a SecureString parameter in Systems Manager Parameter Store, encrypted with a custom AWS KMS customer managed key.
Accessing a SecureString parameter requires both read access to the parameter and decrypt permissions on the underlying KMS key.
2
Evaluate the error type and existing permissions.
The error is AccessDeniedException, indicating a permission restriction rather than a network or service availability issue. The IAM policy already allows ssm:GetParameter and kms:Decrypt.
Since the IAM policy allows the actions, the restriction must reside in another policy type that controls access to the resource.
3
Determine the access control mechanism for custom AWS KMS keys.
Custom AWS KMS keys require explicit permission in their key policies to allow IAM policies to delegate or grant access.
Without the KMS key policy granting permissions to the EC2 role, the KMS request is denied, causing the Parameter Store retrieval to fail with AccessDeniedException.

Key Concept

KMS key policy permissions and precedence when decrypting secure parameters
Estimated Time:1m 30s
Rate this question

Topics

Secrets and Parameters Management

More questions from this topic