DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Add a statement granting kms:Decrypt to the Lambda function's execution role.

  Why this is correct

  When a Lambda function needs to interact with a customer-managed AWS KMS key, the key policy associated with that KMS key must explicitly grant permissions to the entity making the request. The Lambda function assumes an IAM execution role, and it is this role that makes API calls to KMS. Therefore, the KMS key policy must include a statement allowing the kms:Decrypt action for the specific ARN of the Lambda function's execution role, ensuring direct access control and adherence to the principle of least privilege.

• ✗

  Add a statement granting kms:Decrypt to the Lambda function's resource-based policy.

  Why it's wrong here

  Lambda functions themselves do not possess a resource-based policy that directly controls their outbound access to external KMS keys. While Lambda functions do have resource-based policies (also known as access policies) that control who can invoke the function, these policies do not govern the function's permissions to interact with other AWS services. The KMS key policy is the definitive resource policy for the KMS key, dictating which IAM principals can perform cryptographic operations on it.

• ✗

  Add a statement granting kms:Decrypt to the Lambda service principal.

  Why it's wrong here

  Granting kms:Decrypt to the Lambda service principal (lambda.amazonaws.com) is incorrect because the service principal represents the AWS Lambda service itself, not the specific execution context of a user's Lambda function. When a Lambda function executes, it assumes the identity of its designated IAM execution role. This execution role is the actual principal that makes API calls to AWS KMS, and thus, the KMS key policy must grant permissions directly to this role, not the overarching service principal.

• ✗

  Add a statement granting kms:Decrypt to the account root user with a condition for the Lambda function.

  Why it's wrong here

  Granting permissions directly to the account root user, even with a condition, is an insecure and indirect method for providing a Lambda function access to a KMS key. The root user possesses unrestricted administrative privileges across the entire AWS account and should be used sparingly, primarily for initial setup. Best practices dictate that specific IAM roles, like a Lambda execution role, should be granted only the necessary permissions directly via the KMS key policy, adhering to the principle of least privilege and avoiding broad root user access.