Examkin

Soru

Zorluk: KolaySecrets and Parameters Management

An application running on an Amazon EC2 instance needs to retrieve a database connection string stored as a SecureString parameter in AWS Systems Manager Parameter Store. The parameter is encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). Which TWO actions must be allowed in the IAM policy attached to the EC2 instance profile to successfully retrieve the decrypted parameter value? (Select TWO.)

  1. ssm:GetParameterCevap
  2. kms:DecryptCevap
  3. C
    kms:GenerateDataKey
  4. D
    iam:PassRole
  5. E
    secretsmanager:GetSecretValue

Cevap

The correct actions are ssm:GetParameter and kms:Decrypt.
To retrieve a decrypted SecureString parameter from AWS Systems Manager Parameter Store, the EC2 instance's IAM role must be allowed to perform the ssm:GetParameter action on the parameter's ARN, and the kms:Decrypt action on the KMS key used to encrypt the parameter.

Adım Adım Çözüm

1
Determine the Systems Manager Parameter Store API action required.
The application must call ssm:GetParameter to retrieve the parameter data.
Since the secret database connection string is stored in Parameter Store, the ssm:GetParameter action is needed.
2
Determine the KMS permission required to read the encrypted parameter value.
The application must have kms:Decrypt permission for the customer managed key.
A SecureString parameter is encrypted at rest, and the calling principal needs to decrypt it to view the plaintext value.

Anahtar Kavram

To retrieve and decrypt a SecureString parameter from Systems Manager Parameter Store, the client needs both the read permission (ssm:GetParameter) and the decryption permission (kms:Decrypt) for the associated KMS key.
Bu soruyu puanla

Konular

Secrets and Parameters Management

Bu konudan daha fazla soru