Examkin

Soru

Zorluk: OrtaSecrets and Parameters Management

A SysOps administrator is deploying an application on Amazon EC2 instances. The application needs to retrieve database credentials from AWS Systems Manager (SSM) Parameter Store. The credentials are stored as a SecureString parameter named `/prod/db/password` and are encrypted using a customer managed KMS key.

The EC2 instances are associated with an IAM role that has the following policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ssm:GetParameter",
"ssm:GetParameters"
],
"Resource": "arn:aws:ssm:us-east-1:111122223333:parameter/prod/db/password"
},
{
"Effect": "Allow",
"Action": [
"kms:Decrypt"
],
"Resource": "arn:aws:kms:us-east-1:111122223333:key/12345678-abcd-1234-abcd-123456789abc"
}
]
}

Despite this configuration, the application logs show an `AccessDeniedException` when calling the `ssm:GetParameter` API with decryption enabled. Which of the following is the most likely cause of this access denied error?

  1. The KMS key policy for the customer managed key does not allow the EC2 IAM role or the AWS account root principal to perform the `kms:Decrypt` action.Cevap
  2. B
    The administrator must add a permissions boundary to the IAM role that allows the `kms:Decrypt` action, as IAM policies alone cannot grant access to KMS resources without a boundary.
  3. C
    The IAM role policy must include the `iam:PassRole` permission targeting the KMS key to allow Systems Manager to assume the role and decrypt the parameter on behalf of the application.
  4. D
    The subnet route table associated with the EC2 instances is missing a gateway route to the KMS service endpoint, preventing the instance from reaching AWS KMS to perform the decryption.

Cevap

The KMS key policy for the customer managed key does not allow the EC2 IAM role or the AWS account root principal to perform the `kms:Decrypt` action.
For customer managed KMS keys, the key policy is the primary authority. Even if an IAM policy grants `kms:Decrypt` permission to the EC2 IAM role, the request will be denied unless the KMS key policy explicitly permits the role or delegates access control to the account root principal (which allows IAM policies to take effect). Therefore, the lack of permission in the KMS key policy is the cause of the `AccessDeniedException`.

Adım Adım Çözüm

1
Identify the service and components involved in the request.
The application calls SSM Parameter Store (`ssm:GetParameter`) to retrieve a `SecureString` encrypted with a custom KMS key.
Retrieving encrypted parameters requires both read access to the SSM parameter and decrypt access to the associated KMS key.
2
Analyze the IAM policy attached to the EC2 instances.
The IAM policy correctly grants `ssm:GetParameter` on the parameter resource and `kms:Decrypt` on the KMS key resource.
This confirms that identity-based permissions are correctly configured.
3
Evaluate resource-based policy requirements for AWS KMS keys.
Unlike other resources, KMS key policies must explicitly allow IAM policies to govern key access (using the account root principal) or explicitly grant the principal permissions.
Without this delegation in the KMS key policy, identity-based IAM policies cannot grant access to the key, resulting in an `AccessDeniedException`.

Anahtar Kavram

KMS Key Policy Precedence over IAM Policies
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Secrets and Parameters Management

Bu konudan daha fazla soru