DBS-C01 Database Security Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*"
      ],
      "Resource": "arn:aws:kms:us-east-1:123456789012:key/abc12345-1234-1234-1234-123456789012",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "s3.us-east-1.amazonaws.com",
          "kms:CallerAccount": "123456789012"
        }
      }
    }
  ]
}

Refer to the exhibit. A company has attached this IAM policy to an IAM role used by an application running on Amazon EC2. The application needs to decrypt data in an S3 bucket that is encrypted with the specified KMS key. However, the application is receiving access denied errors. What is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The application is decrypting the data by calling KMS directly instead of using S3's server-side decryption.

The policy condition 'kms:ViaService' restricts KMS operations to only when they are made through S3. However, the condition also includes 'kms:CallerAccount' which is redundant but not harmful. The error likely occurs because the EC2 instance does not have the correct IAM role, or the policy is missing 'kms:Decrypt' for the specific ciphertext. But the most common mistake is that the application is not using the S3 service to decrypt; if the application reads the encrypted object and then calls KMS directly to decrypt, the 'kms:ViaService' condition will fail because the call is not via S3. Option B addresses this. Option A is wrong because the condition is present. Option C is wrong because the role is not explicitly denied. Option D is wrong because the policy allows KMS actions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy does not include 'kms:Decrypt' for the specific key.
Why it's wrong here
The policy includes 'kms:Decrypt'.
✓
The application is decrypting the data by calling KMS directly instead of using S3's server-side decryption.
Why this is correct
The 'kms:ViaService' condition requires that the call be made via S3, not directly to KMS.
✗
The policy is missing a 'Principal' element.
Why it's wrong here
The policy is attached to a role, so the principal is implicit.
✗
The IAM role does not have a trust policy that allows EC2 to assume it.
Why it's wrong here
If the role is attached to the EC2 instance, trust policy is configured; the error is not about assuming the role.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

DBS-C01 Database Security Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question