DBS-C01 Database Security Practice Question

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
      ],
      "Resource": "arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "rds.us-east-1.amazonaws.com",
          "aws:SourceVpce": "vpce-12345678"
        }
      }
    }
  ]
}

An IAM policy is attached to a role used by an RDS instance. The RDS instance is in VPC with a VPC endpoint to KMS. What is the effect of this policy?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Allows only the specified KMS actions on the key when the request originates from the RDS service via the specific VPC endpoint.

An IAM policy attached to a role used by an RDS instance, combined with a VPC endpoint to KMS, restricts the allowed KMS actions to only those specified and requires that the request originate from the RDS service via that specific VPC endpoint. Option A is incorrect because it suggests all KMS actions are allowed, which is not the case; only specified actions are allowed. Option B is incorrect because it mistakenly implies the policy allows actions from any source, ignoring the VPC endpoint restriction. Option C is incorrect because it states the policy applies to all KMS keys, whereas it is typically scoped to a specific key.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Allows all KMS actions on the key only when the request comes from RDS.
Why it's wrong here
It also requires the request to come through the VPC endpoint.
✗
Allows all KMS actions on the specified key from any source.
Why it's wrong here
The condition restricts to VPC endpoint and RDS service.
✗
Allows the specified KMS actions on all KMS keys in the account.
Why it's wrong here
The resource is specific to one key.
✓
Allows only the specified KMS actions on the key when the request originates from the RDS service via the specific VPC endpoint.
Why this is correct
The policy has conditions limiting to RDS and VPC endpoint.

Go deeper

DBS-C01 Database Security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question