A company uses an IAM role to allow an application running on Amazon EC2 to decrypt data stored in Amazon S3. The security team wants to enforce that the application can only use the decryption permission when the IAM role has a specific tag (e.g., 'Environment=Production'). Which approach should the security team implement to meet this requirement?

Add a condition to the KMS key policy that uses the 'kms:RequestTag/ConditionKey' to require the tag on the caller.

Incorrect. KMS key policies use condition keys such as 'kms:EncryptionContext' or 'kms:ViaService', but not 'kms:RequestTag/ConditionKey' for principal tags. Principal tags are checked using 'aws:PrincipalTag' in the key policy, but this is not the most straightforward approach and the key policy alone cannot enforce this if the IAM policy also grants permission. Moreover, the option uses an incorrect condition key name.

Add a condition to the IAM role's trust policy that denies the 'kms:Decrypt' action unless the role has the tag.

Incorrect. A role's trust policy controls which principals can assume the role, not what actions the role can perform. The trust policy cannot directly limit the decryption permissions of the role. The permissions are governed by the IAM policy attached to the role.

Add a condition to the S3 bucket policy that denies all access unless the IAM role has the required tag.

Incorrect. An S3 bucket policy controls access to S3 actions (like s3:GetObject), but it does not control the KMS decrypt action. Even if the bucket policy allows access, the application still needs explicit permission to use the KMS key. Additionally, S3 bucket policies can use 'aws:PrincipalTag' conditions, but that would only affect S3 API calls, not the decryption operation.

What does this CLF-C02 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Add a condition to the IAM policy that grants the 'kms:Decrypt' permission with a condition on 'aws:PrincipalTag' to require the tag. — The question tests the ability to use IAM policy conditions to restrict permissions based on the principal's tags. In AWS, you can use the 'aws:PrincipalTag' condition key in an IAM policy to allow or deny actions only when the requesting principal has a specific tag. This is a common pattern for implementing attribute-based access control (ABAC). Option C is correct because it places the condition directly on the IAM policy granting the kms:Decrypt action. Option A is incorrect because KMS key policies use different condition keys (like 'kms:EncryptionContext') and do not directly support 'kms:RequestTag/ConditionKey' for principal tags. Option B is incorrect because a role's trust policy controls who can assume the role, not what actions the role can perform. Option D is incorrect because an S3 bucket policy can restrict access to the bucket itself, but it does not control the KMS decrypt action; KMS permissions are separate.

What should I do if I get this CLF-C02 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.