Examkin

Soru

Zorluk: ZorAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator is configuring an Amazon EC2 Auto Scaling group to launch instances with encrypted Amazon EBS volumes. The EBS volumes must be encrypted using a customer managed AWS KMS key in the same account (123456789012123456789012).

The administrator creates a custom IAM policy that grants the Auto Scaling service-linked role (`AWSServiceRoleForAutoScaling`) permission to perform `kms:Encrypt`, `kms:Decrypt`, `kms:ReEncrypt*`, `kms:GenerateDataKey*`, `kms:DescribeKey`, and `kms:CreateGrant` actions on the KMS key. This policy is successfully attached to the service-linked role.

The KMS key has the following key policy:

{
"Version": "2012-10-17",
"Id": "key-policy-ebs",
"Statement": [
{
"Sid": "Allow administration of the key",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/SysOpsAdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
},
{
"Sid": "Allow cryptographic operations",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/ApplicationServerRole"
},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
}
]
}

When the Auto Scaling group attempts to scale out, the new instances fail to launch, and the activity history indicates a failure to use the KMS key.

Which of the following modifications will resolve this issue?

  1. A
    Attach the custom IAM policy directly to the EC2 instance profile role (ApplicationServerRole) instead of the Auto Scaling service-linked role.
  2. B
    Modify the KMS key policy to remove the 'Allow administration of the key' statement to resolve policy conflicts.
  3. Add a statement to the KMS key policy that grants the AWS account's root principal (arn:aws:iam::123456789012:root) permissions for all KMS actions (kms:*).Cevap
  4. D
    Change the launch template to use the default AWS-managed key aws/ebs, as customer managed KMS keys are not supported by Auto Scaling groups.

Cevap

Add a statement to the KMS key policy that grants the AWS account's root principal (arn:aws:iam::123456789012:root) permissions for all KMS actions (kms:*).
To allow IAM policies to control access to a customer managed KMS key, the key policy must delegate authorization to the AWS account. This is accomplished by adding a policy statement that allows the root principal (`arn:aws:iam::123456789012:root`) to perform `kms:*` actions on the key. Once this root delegation statement is present in the key policy, IAM policies (such as the custom policy attached to the service-linked role) can successfully grant permissions to use the key.

Adım Adım Çözüm

1
Analyze the failed service configuration and error context.
The EC2 Auto Scaling group fails to launch instances with EBS encryption, showing a KMS authorization failure despite the service-linked role having appropriate IAM permissions.
Identify the actors involved and verify if permissions are correctly set in both IAM policies and Key policies.
2
Inspect the KMS key policy for IAM delegation.
The KMS key policy contains specific statements for administrative and cryptographic roles but does not contain the default root principal delegation statement (`arn:aws:iam::123456789012:root`).
KMS key policies are the primary authorization mechanism. Without explicit delegation to the root principal, IAM policies cannot grant access to the key.
3
Determine the required policy modification to allow the service-linked role access.
Add a statement allowing the root principal (`arn:aws:iam::123456789012:root`) to perform `kms:*` actions. This enables IAM authorization evaluation.
By delegating key access control to the account root, the IAM policy attached to the service-linked role is evaluated, authorizing the role's KMS operations.

Anahtar Kavram

AWS KMS Key Policy Precedence and IAM Policy Delegation
Bu soruyu puanla

Konular

AWS Key Management Service (KMS) and Data Encryption

Bu konudan daha fazla soru