DEA-C01 Data Store Management Practice Question

Exhibit

Refer to the exhibit.

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "arn:aws:kms:us-east-1:123456789012:key/abc123"
    },
    {
      "Effect": "Deny",
      "Action": "kms:Decrypt",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:SourceAccount": "123456789012"
        }
      }
    }
  ]
}

A data engineer is troubleshooting an access denied error when an AWS Lambda function tries to decrypt an object encrypted with the KMS key 'abc123'. The Lambda function's execution role has the above policy attached. What is the likely cause of the error?

⚠ Common exam trap

Candidates often assume IAM permissions alone are sufficient for KMS operations, overlooking that KMS key policies must explicitly grant access to the IAM role, which is a common source of access denied errors in cross-account or cross-service scenarios.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The KMS key policy does not grant the Lambda role decrypt permission

The error occurs because KMS requires both the IAM policy and the key policy to grant the necessary permissions. While the IAM policy attached to the Lambda execution role includes kms:Decrypt, the KMS key policy for 'abc123' does not explicitly grant the Lambda role permission to call kms:Decrypt. Since KMS key policies act as a resource-based policy, they must allow the principal (the Lambda role) to perform the action; otherwise, the request is denied even if the IAM policy allows it.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The Deny statement blocks all decrypt requests
Why it's wrong here
A blanket Deny on decrypt requests would be visible in the attached policy, and the stem gives no such statement. It is tempting because an explicit Deny always overrides Allow in IAM evaluation, making it the correct diagnosis when a policy genuinely contains a Deny for kms:Decrypt on that key.
✗
The Lambda function does not have permission to call kms:GenerateDataKey
Why it's wrong here
GenerateDataKey is called during encryption to produce a data key, not during decryption of an existing object, so its absence cannot cause this error. It is tempting because GenerateDataKey and Decrypt are both KMS cryptographic actions, and it is correct when the failure occurs while encrypting rather than decrypting.
✓
The KMS key policy does not grant the Lambda role decrypt permission
Why this is correct
The execution role's identity policy only permits the Lambda to request decryption; the KMS key policy must also allow that principal. If the key policy omits the Lambda role, KMS denies the Decrypt call, producing the access denied error despite the attached policy.
✗
The IAM policy does not include kms:Decrypt permission
Why it's wrong here
The stem states the execution role already carries a policy, and decryption failures from a missing kms:Decrypt statement would be visible in that policy's contents. It is tempting because kms:Decrypt is genuinely required to decrypt data keys, so it is the right answer when the attached policy omits that action.

Quick reference

Cloud Service Model Comparison

Model	You Manage	Provider Manages	Examples
IaaS	OS, runtime, apps, data	Hardware, hypervisor, networking	EC2, Azure VMs, GCP Compute Engine
PaaS	Apps and data	OS, runtime, middleware, hardware	Elastic Beanstalk, Azure App Service
SaaS	Data and settings only	Everything else	Microsoft 365, Salesforce, Workday
FaaS / Serverless	Function code only	Infra, scaling, runtime	Lambda, Azure Functions, Cloud Run
CaaS	Containers and apps	Kubernetes, OS, hardware	EKS, AKS, GKE

Go deeper

DEA-C01 Data Store Management Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Cloud Service Model Comparison

Related to this question