A SysOps Administrator is configuring permissions for an IAM user in the same AWS account to encrypt and decrypt data using a customer managed key in AWS Key Management Service (AWS KMS). Currently, the IAM user has an IAM policy attached that allows all KMS actions on the key, but they are still receiving an Access Denied error when attempting to use the key.
Which of the following actions must be taken to successfully enable access for the user? (Select TWO.)
- Modify the customer managed key's policy to grant permission to the AWS account's root principal, enabling IAM policies to manage key access.Cevap
- Assign an IAM policy directly to the IAM user containing explicit permissions for the encrypt and decrypt actions targeting the key's ARN.Cevap
- CModify the IAM user policy to include iam:PassRole permissions for the KMS key's ARN, allowing the user to assume the key's permissions.
- DRely solely on the IAM policy, because user-level IAM policies automatically override KMS key policies for resources in the same account.
- EAssociate the KMS key with a Gateway VPC Endpoint policy to allow the key's traffic to bypass standard key policy checks.
Cevap
Modify the customer managed key's policy to grant permission to the AWS account's root principal, and assign an IAM policy directly to the IAM user containing explicit permissions for the encrypt and decrypt actions targeting the key's ARN.
For an IAM user in the same account to use a customer managed KMS key, two conditions must be met: the KMS key policy must delegate access control to the account (typically by granting the account root principal administrative or usage permissions), and the user must be granted the necessary permissions (such as encrypt and decrypt) in an IAM policy. These two policies work together to allow access.
Adım Adım Çözüm
Anahtar Kavram
AWS KMS Key Policy Precedence and IAM Policy Integration