A SysOps Administrator is attempting to grant an IAM user permission to decrypt data using an AWS Key Management Service (KMS) customer managed key. The administrator attaches an IAM policy to the user that allows the `kms:Decrypt` action on the key's ARN. However, the user still receives an 'Access Denied' error when trying to perform decryption.
What is the most likely cause of this issue?
- The key policy of the KMS key does not contain a statement that delegates authorization control to IAM policies.Cevap
- BThe IAM user has not been granted the `iam:PassRole` permission, which is required to pass the key's execution role to the KMS service.
- CThe VPC route table has not been associated with a Gateway VPC Endpoint for KMS to route the decryption API call privately.
- DThe S3 bucket containing the encrypted objects does not have bucket versioning enabled, which is required to process KMS decryption requests.
Cevap
The key policy of the KMS key does not contain a statement that delegates authorization control to IAM policies.
For an IAM policy to successfully grant access to a KMS customer managed key, the KMS key policy itself must contain a statement that enables IAM policies to do so. In KMS, the key policy is the primary resource-based policy and acts as the gatekeeper. By default, when a customer managed key is created, AWS adds a policy statement that allows the account's root user (and thereby IAM policies in the account) to define permissions. If this statement is missing or removed, IAM policies attempting to grant KMS access will be ignored, resulting in an 'Access Denied' error.
Adım Adım Çözüm
Anahtar Kavram
AWS KMS Key Policy Delegation to IAM