Examkin

Soru

Zorluk: OrtaAWS Key Management Service (KMS) and Data Encryption

An administrator is troubleshooting an application running on an Amazon EC2 instance that needs to decrypt sensitive database backups retrieved from an Amazon S3 bucket. The backups are encrypted using a customer managed KMS key. Although the administrator has attached an IAM policy to the EC2 instance's IAM role that grants `kms:Decrypt` permissions for the key's Amazon Resource Name (ARN), the application still receives an Access Denied error when attempting to decrypt.

Which of the following configuration changes or verifications must the administrator perform to resolve this issue? (Select TWO.)

  1. Verify that the KMS key policy contains a statement that allows the EC2 instance's IAM role, or the account's root principal, to perform the `kms:Decrypt` action.Cevap
  2. Verify that the customer managed KMS key is in the Enabled state and has not been disabled or scheduled for deletion.Cevap
  3. C
    Add a statement to the EC2 instance's IAM policy to explicitly override the KMS key policy, as IAM permissions automatically take precedence over key policies.
  4. D
    Associate the subnet's route table with an AWS KMS gateway VPC endpoint to route decryption requests privately to KMS.
  5. E
    Attach an IAM policy to the EC2 instance's IAM role that grants `iam:PassRole` permissions for the customer managed KMS key.

Cevap

To resolve the decryption failure, the administrator must verify that the KMS key policy permits access (either directly or via IAM delegation) and ensure that the key is in the Enabled state.
The correct configurations involve ensuring that the key policy delegates access to IAM policies or the specific principal, and that the key is in the Enabled state. For customer managed keys, the key policy is the ultimate authority; IAM policies cannot grant access to a KMS key unless the key policy explicitly allows it (often by granting access to the root account principal). Furthermore, a KMS key must be enabled to perform cryptographic operations like decryption.

Adım Adım Çözüm

1
Analyze the KMS key policy configuration.
Determine if the key policy delegates authority to IAM policies or directly trusts the EC2 instance's role.
For customer managed KMS keys, key policies are the primary policy document and must permit access; IAM policies alone are insufficient.
2
Check the operational state of the KMS key.
Verify the key is not in a disabled, pending import, or pending deletion state.
KMS cryptographic actions require the key to be in the Enabled state to function.

Anahtar Kavram

Understanding KMS key policy precedence and key state lifecycle for cryptographic operations.
Bu soruyu puanla

Konular

AWS Key Management Service (KMS) and Data Encryption

Bu konudan daha fazla soru