Examkin

Soru

Zorluk: OrtaAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator is configuring an AWS CodeBuild project to decrypt sensitive environment variables retrieved from AWS Systems Manager Parameter Store. The parameters are encrypted with a customer managed KMS key in AWS Account `111122223333`. The administrator has already added `kms:Decrypt` and `kms:DescribeKey` permissions to the CodeBuild service role's IAM policy.

The customer managed KMS key has the following key policy:

{
"Version": "2012-10-17",
"Id": "key-policy-1",
"Statement": [
{
"Sid": "Allow direct access to key administrators",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/KMSAdminRole"
},
"Action": [
"kms:Create*",
"kms:Describe*",
"kms:Enable*",
"kms:List*",
"kms:Put*",
"kms:Update*",
"kms:Revoke*",
"kms:Disable*",
"kms:Get*",
"kms:Delete*",
"kms:TagResource",
"kms:UntagResource",
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
"Resource": "*"
}
]
}

When CodeBuild attempts to decrypt the parameters, the build fails with an Access Denied error.

Which of the following modifications will resolve this issue?

  1. A
    Modify the CodeBuild service role's IAM policy to grant KMS permissions on all resources (*) instead of specifying the KMS key ARN.
  2. B
    Add iam:PassRole permissions for the KMS key to the CodeBuild service role's IAM policy to allow the build container to assume the key's permissions.
  3. C
    Add a resource-based policy to the Systems Manager parameter that explicitly grants kms:Decrypt permission to the CodeBuild service role.
  4. Add a statement to the KMS key policy that grants the AWS account root principal (arn:aws:iam::111122223333:root) permission to perform kms:* actions, which allows IAM policies in the account to delegate key permissions.Cevap

Cevap

Add a statement to the KMS key policy that grants the AWS account root principal (arn:aws:iam::111122223333:root) permission to perform kms:* actions, which allows IAM policies in the account to delegate key permissions.
In AWS KMS, the key policy is the primary controller of access. For IAM policies in the same account to grant access to a KMS key, the key policy must contain a statement that enables IAM policies. This is typically achieved by granting the AWS account root principal (arn:aws:iam::111122223333:root) permissions to perform KMS actions (kms:*). Since the current key policy only allows administrative actions for the KMSAdminRole and does not have the default delegation statement for the account root, the CodeBuild role's IAM policy has no effect and results in an Access Denied error. Adding the delegation statement to the key policy enables IAM policies to delegate key access.

Adım Adım Çözüm

1
Analyze the IAM policy of the CodeBuild service role.
The identity-based IAM policy has the correct kms:Decrypt and kms:DescribeKey permissions attached.
This ensures the identity-side configuration is correct and that the failure is due to the key policy.
2
Evaluate the KMS key policy.
The key policy only lists KMSAdminRole and only for administration actions. The default statement delegating control to the account root (arn:aws:iam::111122223333:root) is missing.
KMS key policies must explicitly allow IAM delegation (via the root principal) for identity-based IAM policies to have any effect.
3
Identify the remediation step.
Add the root principal statement to the key policy to enable IAM delegation.
This establishes key policy delegation, permitting the CodeBuild service role's IAM policy to grant the decryption permissions.

Anahtar Kavram

KMS Key Policy Delegation
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS Key Management Service (KMS) and Data Encryption

Bu konudan daha fazla soru