Examkin

Soru

Zorluk: OrtaAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator is configuring a customer managed KMS key in AWS account 111122223333. The key is used to encrypt backups. The administrator configures a custom key policy that grants permissions to a backup role but removes the default statement that delegates key permissions to the account's root user. Later, an administrator with the AdministratorAccess IAM policy attached to their user attempts to modify the key policy but receives an AccessDeniedException. Which of the following statements correctly explain this behavior or identify the configurations required to resolve the issue? (Select TWO.)

  1. Without the root principal delegation statement in the key policy, IAM policies alone cannot grant access to the customer managed KMS key.Cevap
  2. The key policy must be modified to explicitly list the administrator's IAM principal or restore the default policy statement delegating control to the account's IAM policies.Cevap
  3. C
    The administrator can bypass the restriction by attaching the AdministratorAccess IAM policy, which overrides any custom resource-based policies.
  4. D
    The administrator must enable default key rotation on the KMS key before any IAM administrative permissions can take effect.
  5. E
    The administrator can use AWS Systems Manager to temporarily assume the KMS service principal to bypass the key policy evaluation.

Cevap

Without the root principal delegation statement in the key policy, IAM policies alone cannot grant access to the customer managed KMS key. To resolve the issue, the key policy must be modified to explicitly list the administrator's IAM principal or restore the default policy statement delegating control to the account's IAM policies.
In AWS KMS, key policies are the primary way to control access to keys. If a customer managed key's policy does not delegate control to the account's root principal (which allows the account to use IAM policies), then IAM policies alone are insufficient to grant access. To fix the AccessDeniedException, the administrator must either be explicitly permitted in the key policy, or the root principal delegation statement must be restored to allow IAM policies (like AdministratorAccess) to govern access to the key.

Adım Adım Çözüm

1
Analyze the policy evaluation path for AWS KMS.
Identify that AWS KMS key policies are resource-based and always evaluated. If the default statement delegating control to the account's root user is missing, IAM policies have no effect on the KMS key.
This explains why the administrator with AdministratorAccess still receives an AccessDeniedException.
2
Determine the required modifications to the KMS key policy.
The administrator must either add their specific IAM principal to the KMS key policy's Principal element or restore the default delegation statement ('arn:aws:iam::111122223333:root').
This establishes a valid permission path from either the key policy directly or via IAM delegation.

Anahtar Kavram

AWS KMS Key Policy Precedence and IAM Delegation
Bu soruyu puanla

Konular

AWS Key Management Service (KMS) and Data Encryption

Bu konudan daha fazla soru