Examkin

Soru

Zorluk: OrtaResolving IAM and Authorization Failures

A developer has deployed a Java application on an Amazon EC2 instance. The application is designed to retrieve database credentials from AWS Secrets Manager using the AWS SDK. The credentials are encrypted using a customer managed AWS KMS key. The EC2 instance is associated with an IAM instance profile that has the following IAM policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue"
],
"Resource": "arn:aws:secretsmanager:us-east-1:123456789012:secret:ProductionDatabaseSecret-xyz789"
}
]
}

When the application attempts to retrieve the secret value, it receives an `AccessDeniedException` error. Which two actions should the developer take to resolve this authorization failure? (Select TWO.)

  1. Add the `kms:Decrypt` permission to the IAM policy attached to the EC2 instance's IAM role for the customer managed KMS key.Cevap
  2. Update the key policy of the customer managed KMS key to grant the EC2 instance's IAM role permission to perform the `kms:Decrypt` action.Cevap
  3. C
    Update the trust policy of the EC2 instance's IAM role to allow the AWS Secrets Manager service principal (`secretsmanager.amazonaws.com`) to assume the role.
  4. D
    Modify the application code to initialize the Secrets Manager client by hardcoding the AWS access key ID and secret access key of an IAM user that has administrative privileges.
  5. E
    Configure an Amazon Cognito Identity Pool to exchange the EC2 instance profile's temporary credentials for a new Cognito User Pool session that has KMS decrypt permissions.

Cevap

To resolve the authorization failure, the developer must grant decrypt permissions on the KMS key to the EC2 instance's IAM role, and update the KMS key's key policy to trust the EC2 instance's IAM role to perform the decryption.
When a secret in AWS Secrets Manager is encrypted with a customer managed KMS key, any entity attempting to retrieve that secret must have permissions for both `secretsmanager:GetSecretValue` and `kms:Decrypt`. Because the encryption key is customer managed, authorization requires a union of permissions from both the caller's identity policy (the EC2 instance's IAM role policy) and the resource-based policy of the KMS key (the KMS key policy). The correct options ensure that the EC2 role is granted decrypt permissions in both policy locations.

Adım Adım Çözüm

1
Identify the encryption key used by the Secrets Manager secret.
Confirm that the secret is encrypted with a customer managed KMS key rather than the default `aws/secretsmanager` key.
Default keys automatically allow the account's roles to perform decrypt operations, but customer managed KMS keys require explicit policy definitions on both the IAM role and the KMS key policy.
2
Update the IAM policy of the EC2 instance's role.
Add the `kms:Decrypt` action targeting the ARN of the customer managed KMS key.
This grants the EC2 instance application permission to execute the decryption operation through the AWS SDK when calling Secrets Manager.
3
Update the KMS key policy.
Modify the key policy to allow the ARN of the EC2 instance's role to perform `kms:Decrypt`.
KMS key policies act as resource-based boundaries; without permission in the key policy, IAM policies alone cannot grant access to a customer managed KMS key.

Anahtar Kavram

Resolving Access Denied errors in Secrets Manager when customer managed KMS keys are used by ensuring permissions exist on both the client IAM policy and the resource-based KMS key policy.
Bu soruyu puanla

Konular

Resolving IAM and Authorization Failures

Bu konudan daha fazla soru