DEA-C01 Data Security and Governance Practice Question
A data engineer needs to grant an IAM user read-only access to a specific KMS key for decrypting S3 objects. Which policy element should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a statement to the KMS key policy allowing the IAM user to call kms:Decrypt
KMS key policies are resource-based policies that directly grant permissions to IAM users or roles to perform actions on the key. To grant an IAM user read-only access (kms:Decrypt) to a specific KMS key, the recommended approach is to add a statement in the key policy that allows that user to call kms:Decrypt. Option A is incorrect because an IAM policy alone cannot grant KMS permissions unless the key policy explicitly allows it (by default, key policies must allow IAM policies). Option C is incorrect because bucket policies cannot grant kms:Decrypt permissions; they can only specify conditions for using KMS keys. Option D is incorrect because SCPs are used in AWS Organizations to set permission boundaries, not to grant permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an IAM policy to the user allowing kms:Decrypt
Why it's wrong here
Incorrect. IAM policies alone cannot grant permissions to a KMS key unless the key policy explicitly allows the use of IAM policies. By default, KMS key policies do not allow IAM policies to grant access, so this approach will not work. The key policy must be modified to allow the specific user.
- ✓
Add a statement to the KMS key policy allowing the IAM user to call kms:Decrypt
Why this is correct
Correct. KMS key policies are resource-based policies that directly grant permissions to IAM users or roles to perform actions on the key. Adding a statement to the key policy allowing the IAM user to call kms:Decrypt is the recommended method.
- ✗
Add a bucket policy that grants kms:Decrypt
Why it's wrong here
Incorrect. S3 bucket policies can specify conditions for using KMS keys (like requiring encryption with a specific key), but they cannot grant kms:Decrypt permissions. The bucket policy can only control access to the S3 object, not the KMS key itself.
- ✗
Use an SCP in AWS Organizations to allow kms:Decrypt
Why it's wrong here
Incorrect. Service control policies (SCPs) in AWS Organizations can only set permission boundaries and deny permissions, but they cannot grant permissions. SCPs are not used to grant access to KMS keys.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,711 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.