DEA-C01 Data Security and Governance Practice Question
A data engineer needs to share an S3 bucket with another AWS account. They want to ensure that the objects in the bucket remain encrypted with SSE-KMS using a customer managed key. What additional step is required for cross-account access?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the KMS key policy to grant the target account kms:Decrypt permission
When using SSE-KMS with a customer managed key, cross-account access requires the KMS key policy to grant the target account's IAM role or user the necessary KMS permissions (kms:Decrypt, and optionally kms:GenerateDataKey). The S3 bucket policy must also grant s3:GetObject, and the target account's IAM policy must allow kms:Decrypt. However, the key policy is the additional step specific to KMS that is not covered by S3 policies alone. Without it, the target account cannot use the key. Option A is correct because modifying the key policy is essential. Option B is insufficient because the target account's IAM policy cannot override the key policy. Option C is unnecessary and breaks encryption. Option D provides S3 access but not KMS access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the KMS key policy to grant the target account kms:Decrypt permission
Why this is correct
Cross-account SSE-KMS access requires both the S3 bucket policy and the KMS key policy to permit the target account. Because the key is customer managed, its key policy must explicitly grant the other account kms:Decrypt, otherwise S3 cannot unwrap the data key for that account's requests.
- ✗
Add an IAM policy in the target account to allow kms:Decrypt
Why it's wrong here
An IAM policy in the target account granting kms:Decrypt authorises only the target principal; the customer managed key's own key policy must also permit that account, and without it decryption fails. It is tempting because the target account's IAM policy is normally required for cross-account KMS use.
- ✗
Disable SSE-KMS encryption on the bucket
Why it's wrong here
Disabling SSE-KMS removes the encryption the scenario explicitly requires, so the objects would no longer be protected by the customer managed key. It is tempting because removing KMS avoids the cross-account key policy problem entirely, which is why it is chosen when encryption is optional.
- ✗
Add a bucket policy that grants the target account s3:GetObject
Why it's wrong here
A bucket policy granting s3:GetObject authorises the S3 read but does nothing for the SSE-KMS encryption layer, so the target account still cannot decrypt the objects. It is tempting because a bucket policy is the standard mechanism for granting cross-account access to unencrypted or SSE-S3 objects.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,321 original DEA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.