Examkin

Soru

Zorluk: ZorAWS Key Management Service (KMS) and Data Encryption

An organization is auditing its KMS key configurations. A SysOps Administrator is reviewing a customer managed key (CMK) in Account 111122223333111122223333. The key is used to encrypt an Amazon S3 bucket containing sensitive compliance logs.

The KMS key policy is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Allow Key Administration",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/AdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
},
{
"Sid": "Allow S3 Service Access",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "*"
}
]
}

An IAM role in the same account (111122223333111122223333), `AppExecutionRole`, needs to read objects from this S3 bucket. The administrator attaches the following IAM policy to `AppExecutionRole`:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "S3AndKMSRead",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"kms:Decrypt"
],
"Resource": [
"arn:aws:s3:::compliance-logs-111122223333/*",
"arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
]
}
]
}

However, when an application using the `AppExecutionRole` attempts to retrieve an object from the S3 bucket, it receives an "Access Denied" error from KMS.

Which action should the SysOps Administrator take to resolve this issue?

  1. A
    Modify the IAM policy attached to `AppExecutionRole` to set the resource for the `kms:Decrypt` action to a wildcard (`*`).
  2. B
    Add a statement to the S3 bucket policy of `compliance-logs-111122223333` that explicitly grants the `AppExecutionRole` permission to perform `kms:Decrypt` on the KMS key.
  3. Add a statement to the KMS key policy that grants the AWS account root principal (`arn:aws:iam::111122223333:root`) access to the `kms:*` actions on the key, allowing IAM policies to delegate permissions.Cevap
  4. D
    Configure an IAM role trust policy on `AppExecutionRole` that allows the KMS service principal (`kms.amazonaws.com`) to assume the role.

Cevap

Add a statement to the KMS key policy that grants the AWS account root principal (`arn:aws:iam::111122223333:root`) access to the `kms:*` actions on the key, allowing IAM policies to delegate permissions.
The correct action is to add the account root principal statement to the KMS key policy. Unlike other AWS resources where IAM policies are sufficient if they are in the same account, KMS requires that the key policy explicitly allows the actions or delegates access control to the account's IAM policies. By adding a statement that grants the root principal (`arn:aws:iam::111122223333:root`) access to `kms:*`, you enable the account's IAM policies to delegate access to the key. This allows the IAM policy attached to the `AppExecutionRole` to take effect.

Adım Adım Çözüm

1
Identify the authorization model for AWS KMS keys.
KMS key policies are the primary authorization mechanism, and IAM policies are ignored unless the key policy explicitly delegates authority to IAM.
To understand why the application is getting 'Access Denied' despite having a valid IAM policy.
2
Examine the provided KMS key policy for IAM delegation.
The key policy allows access only to `AdminRole` and the S3 service principal (`s3.amazonaws.com`). It does not contain a statement delegating authority to the AWS account root principal (`arn:aws:iam::111122223333:root`).
To diagnose why the IAM policy on `AppExecutionRole` is not taking effect.
3
Determine the correct modification to allow IAM policies to grant access.
Add a statement to the KMS key policy that grants the root account (`arn:aws:iam::111122223333:root`) permissions for `kms:*` on the key.
This delegates key access control to the account's IAM policies, enabling the IAM policy attached to `AppExecutionRole` to successfully grant access.

Anahtar Kavram

AWS KMS Key Policy vs IAM Policy precedence and the requirement of root principal delegation to enable IAM-based KMS authorizations.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

AWS Key Management Service (KMS) and Data Encryption

Bu konudan daha fazla soru