Examkin

Soru

Zorluk: OrtaAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator in Account A is attempting to create an Amazon Elastic Block Store (EBS) volume from an encrypted EBS snapshot shared by Account B. The snapshot was encrypted using the default AWS managed key (aws/ebs) in Account B. The administrator's IAM user in Account A has full administrator permissions (AdministratorAccess), but the attempt to create the volume fails with an access denied error. Which of the following actions must be taken to successfully create the EBS volume in Account A? (Select TWO.)

  1. In Account B, copy the snapshot and encrypt the copy using a customer managed KMS key.Cevap
  2. In Account B, update the key policy of the new customer managed KMS key to grant Account A permissions to perform the kms:Decrypt and kms:CreateGrant actions.Cevap
  3. C
    In Account B, modify the key policy of the default AWS managed key (aws/ebs) to grant Account A access to use the key.
  4. D
    In Account A, attach an IAM policy to the administrator's IAM user that allows the kms:Decrypt and kms:CreateGrant actions on the default AWS managed key in Account B.
  5. E
    In Account A, use the AWS CLI to copy the shared snapshot to Account A, specifying a customer managed KMS key in Account A as the target key.

Cevap

To resolve the issue, the snapshot in Account B must be copied and encrypted with a customer managed KMS key. Then, the key policy of that customer managed key in Account B must be updated to grant Account A permissions to perform kms:Decrypt and kms:CreateGrant actions.
Because AWS managed KMS keys cannot be shared across accounts, the snapshot must first be copied in Account B and encrypted using a customer managed KMS key. Once encrypted with a customer managed key, the key policy must be updated to grant Account A access. Specifically, the key policy must allow the kms:Decrypt action to read the snapshot data, and the kms:CreateGrant action to allow the EC2 service in Account A to attach the resulting volume.

Adım Adım Çözüm

1
Identify the key type used to encrypt the source snapshot.
The snapshot is encrypted with the default AWS managed key (aws/ebs).
AWS managed keys cannot be shared across accounts, meaning the snapshot cannot be decrypted by Account A in its current state.
2
Re-encrypt the snapshot with a shareable key in the source account.
A copy of the snapshot is created in Account B, encrypted with a customer managed KMS key.
Customer managed KMS keys support key policy modifications, enabling cross-account sharing.
3
Configure cross-account permissions on the customer managed KMS key.
The KMS key policy in Account B is updated to allow Account A permissions to decrypt and create grants.
Account A needs kms:Decrypt to read the snapshot data and kms:CreateGrant because the Amazon EC2 service in Account A must create a cryptographic grant to attach the volume.

Anahtar Kavram

AWS managed keys cannot be shared across accounts. For cross-account resource sharing (such as EBS snapshots or RDS backups), the resource must be encrypted with a customer managed KMS key, and the key policy must grant permissions (including kms:CreateGrant for EBS/EC2) to the target account.
Bu soruyu puanla

Konular

AWS Key Management Service (KMS) and Data Encryption

Bu konudan daha fazla soru