Examkin

Soru

Zorluk: KolayIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator has configured an Amazon EC2 instance to upload files to an Amazon S3 bucket. The bucket is encrypted using a customer managed key (CMK) in AWS Key Management Service (AWS KMS). The administrator has attached an IAM policy to the EC2 instance's IAM role that grants 's3:PutObject' permission. However, when the application on the EC2 instance attempts to write to the S3 bucket, it receives an Access Denied error. Which configuration change will resolve this issue?

  1. Update the KMS key policy to allow the EC2 instance's IAM role permissions for the 'kms:GenerateDataKey' and 'kms:Decrypt' actions.Cevap
  2. B
    Attach an IAM policy to the EC2 instance's IAM role that grants the 'kms:GenerateDataKey' and 'kms:Decrypt' permissions without modifying the KMS key policy.
  3. C
    Add the 'iam:PassRole' permission to the EC2 instance's IAM role to allow the S3 service to assume the role and access the KMS key.
  4. D
    Configure an Amazon S3 Gateway VPC Endpoint in the VPC and associate it with the subnet's route table.

Cevap

Update the KMS key policy to allow the EC2 instance's IAM role permissions for the 'kms:GenerateDataKey' and 'kms:Decrypt' actions.
The correct answer is to update the KMS key policy to allow the EC2 instance's IAM role permissions for the 'kms:GenerateDataKey' and 'kms:Decrypt' actions. When writing to an S3 bucket encrypted with a customer managed key, the client must request a data key from KMS to encrypt the object before uploading it. Therefore, the IAM role needs KMS permissions, and because KMS key policies are the primary authority for key access, the KMS key policy must be updated to allow the IAM role to perform these actions.

Adım Adım Çözüm

1
Identify the resource-based policy that controls access to the KMS key.
The KMS customer managed key has a key policy that governs access, separate from S3 bucket policies.
AWS KMS requires a key policy to authorize key usage, and IAM policies alone are not sufficient unless explicitly enabled by the key policy.
2
Determine the required API actions for writing encrypted data to S3.
Writing to a KMS-encrypted S3 bucket requires 'kms:GenerateDataKey' and 'kms:Decrypt' permissions.
The client must generate a data key to encrypt the object metadata/payload and decrypt keys during write verification.
3
Modify the KMS key policy to include the EC2 instance's IAM role ARN as a principal allowed to perform these actions.
The Access Denied error is resolved and the application can successfully upload files.
This establishes the necessary trust relationship and grants the required key usage permissions directly to the IAM role.

Anahtar Kavram

KMS key policies take precedence over IAM policies, and accessing a KMS-encrypted S3 bucket requires both S3 and KMS permissions.
Bu soruyu puanla

Konular

IAM Policies, Roles, and Service Control Policies (SCPs)

Bu konudan daha fazla soru