A SysOps Administrator in AWS Account `123456789012` is configuring access to a customer managed KMS key. The administrator wants to grant access to an IAM user named `DataOperator`. The administrator attaches the following IAM policy to the user:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt"
],
"Resource": "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"
}
]
}
When the `DataOperator` user attempts to encrypt a payload using the AWS CLI, they receive an `AccessDeniedException` error. The administrator checks the KMS key policy and finds it only allows access to a specific administration role.
Which of the following describes the cause of this issue and the correct resolution?
- The customer managed KMS key policy does not delegate access control to IAM policies. To resolve this, the administrator must modify the KMS key policy to grant the AWS account root principal permissions to perform KMS actions, or explicitly add the IAM user to the key policy.Cevap
- BThe user's IAM policy is missing the `kms:GenerateDataKey` action. To resolve this, the administrator must update the IAM policy to include `kms:GenerateDataKey`, which is required for direct client-side encryption using the AWS CLI.
- CThe user is missing `iam:PassRole` permissions for the KMS key. To resolve this, the administrator must add the `iam:PassRole` action targeting the KMS key ARN to the user's IAM policy.
- DKMS keys cannot be accessed using IAM policies. To resolve this, the administrator must create a KMS Grant that references the user's IAM policy and specifies the allowed encryption operations.