DEA-C01 Data Security and Governance Practice Question

A data engineer needs to grant an IAM role used by an AWS Lambda function permission to read encrypted data from an Amazon S3 bucket. The data is encrypted with a customer-managed AWS KMS key. The engineer wants to follow the principle of least privilege. Which combination of actions should the engineer include in the IAM policy for the Lambda execution role?

⚠ Common exam trap

Watch out — candidates often confuse KMS actions, such as using kms:Encrypt or kms:GenerateDataKey instead of kms:Decrypt for reading encrypted data.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

s3:GetObject on the bucket and kms:Decrypt on the KMS key.

The Lambda function requires s3:GetObject to retrieve the object and kms:Decrypt to decrypt the data key used by S3 server-side encryption with KMS. These permissions are the minimal set needed to read the encrypted object. Other KMS actions like Encrypt, GenerateDataKey, or CreateGrant do not provide decryption capability and would not allow the function to read the data.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
s3:GetObject on the bucket and kms:Decrypt on the KMS key.
Why this is correct
To read an encrypted object from S3, the Lambda function needs s3:GetObject permission on the object and kms:Decrypt permission on the KMS key used to encrypt the object. Without kms:Decrypt, S3 cannot decrypt the object for the caller. This combination follows least privilege by granting only the necessary actions for reading the specific data.
✗
s3:GetObject on the bucket and kms:GenerateDataKey on the KMS key.
Why it's wrong here
kms:GenerateDataKey is used to generate a data key for client-side encryption or for S3 to use when encrypting objects, not for decrypting existing objects. For reading, the service needs to decrypt the data key, which requires kms:Decrypt. Granting GenerateDataKey does not allow decryption and would not enable reading the object.
✗
s3:GetObject on the bucket and kms:CreateGrant on the KMS key.
Why it's wrong here
kms:CreateGrant allows creating grants on a KMS key, which can delegate permissions, but it does not directly allow decryption. The Lambda function needs kms:Decrypt to read the encrypted object. CreateGrant is typically used for granting temporary permissions and is not the correct action for direct decryption.
✗
s3:GetObject on the bucket and kms:Encrypt on the KMS key.
Why it's wrong here
kms:Encrypt allows encrypting data but not decrypting it. The Lambda function needs to decrypt the data to read it, so kms:Encrypt is insufficient. This would result in an access denied error when attempting to read the encrypted object. The correct permission for reading is kms:Decrypt.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question