A SysOps Administrator is configuring a customer managed KMS key in an AWS account to encrypt sensitive application logs. The administrator attaches an IAM policy to a developer's IAM role that grants `kms:Decrypt` and `kms:GenerateDataKey` permissions for the KMS key. However, when the developer attempts to read the encrypted logs, they receive an 'AccessDenied' error. The administrator inspects the KMS key policy, which contains the following statement:
{
"Version": "2012-10-17",
"Id": "key-default-1",
"Statement": [
{
"Sid": "Allow administration of the key",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/AdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
}
]
}
Which action will resolve this issue and allow the developer to access the logs?
- Modify the KMS key policy to grant the AWS account root principal (`arn:aws:iam::123456789012:root`) permissions to perform KMS actions, enabling the IAM policy attached to the developer's role to take effect.Cevap
- BAdd the `kms:Decrypt` and `kms:GenerateDataKey` permissions directly to the log storage resource's bucket policy, which overrides the KMS key policy.
- CModify the developer's IAM policy to include the `kms:DescribeKey` permission, as IAM policies automatically override KMS key policies when administrative access is configured.
- DCreate a resource-based IAM policy, attach it directly to the KMS key, and enable automatic key rotation to sync permissions across the account.