Refer to the exhibit.

Exhibit:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:role/DataEngineer"
},
"Action": [
"kms:Decrypt",
"kms:ReEncrypt*"
],
"Resource": "*"
}
]
}

A data engineer tries to encrypt data using the KMS key associated with this key policy and receives an access denied error. What is the cause?

Question

Refer to the exhibit.

Exhibit:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/DataEngineer"
      },
      "Action": [
        "kms:Decrypt",
        "kms:ReEncrypt*"
      ],
      "Resource": "*"
    }
  ]
}

A data engineer tries to encrypt data using the KMS key associated with this key policy and receives an access denied error. What is the cause?

Accepted Answer

The policy does not include kms:Encrypt action. The key policy grants Decrypt and ReEncrypt* actions, but not Encrypt. Therefore, the DataEngineer role does not have permission to encrypt data using this key. Option A is incorrect because IAM roles can be used as principals in key policies. Option B is incorrect because there is no explicit deny statement in the policy. Option C is incorrect because "Resource": "*" is valid in KMS key policies and refers to the current key.

Answer

The principal is an IAM role, which is not allowed

Answer

There is an explicit deny in the policy

Answer

The Resource element is set to "*", which is invalid for KMS key policies

DEA-C01 Data Security and Governance Practice Question

Why each option matters

Option-by-option breakdown

Related to this question