DVA-C02 Security Practice Question
A company wants to encrypt data at rest in Amazon S3 using server-side encryption with KMS (SSE-KMS). They want to ensure that only certain IAM roles can decrypt objects. What must be configured?
⚠ Common exam trap
It's easy for candidates to assume an IAM role policy granting kms:Decrypt is sufficient, forgetting that KMS key policies act as an independent access control layer that can explicitly deny or allow access, and without the key policy granting the role, the IAM policy is ineffective.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
KMS key policy to allow the IAM roles to decrypt
SSE-KMS uses a customer master key (CMK) to encrypt and decrypt S3 objects. The KMS key policy is the primary access control mechanism for a CMK; it must explicitly grant the IAM roles the kms:Decrypt permission. Without this policy statement, even if the IAM roles have a policy allowing kms:Decrypt, they will be denied access because KMS key policies can override IAM permissions when the key policy does not grant access to the account's IAM principals.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM role policy to allow kms:Decrypt
Why it's wrong here
An IAM role policy grants permissions to a principal, but for AWS Key Management Service (KMS) operations, both the IAM policy and the KMS key policy must explicitly allow the action. If the KMS key policy does not grant the specific IAM role permission to use the key, the IAM policy alone is insufficient. The KMS key policy serves as the ultimate access control layer, overriding any permissions granted solely by an IAM policy for key usage.
- ✗
S3 bucket policy to allow decrypt
Why it's wrong here
An S3 bucket policy controls access to the S3 bucket and its objects, defining who can perform actions like `s3:GetObject` or `s3:PutObject`. However, S3 bucket policies operate strictly within the S3 service context and cannot grant permissions for other AWS services, such as `kms:Decrypt`. KMS key operations are governed by KMS key policies and IAM policies, making an S3 bucket policy an inappropriate mechanism for granting KMS decryption permissions.
- ✓
KMS key policy to allow the IAM roles to decrypt
Why this is correct
For an IAM role to successfully decrypt data encrypted with an AWS KMS Customer Managed Key (CMK), the KMS key policy associated with that specific CMK must explicitly allow the IAM role to perform the `kms:Decrypt` action. This is a critical requirement because the key policy is the definitive access control mechanism for the KMS key, dictating which principals are authorized to use it. Without this explicit permission in the key policy, decryption attempts by the IAM role will fail, even if the role's IAM policy permits `kms:Decrypt`.
- ✗
KMS key policy to allow s3.amazonaws.com to decrypt
Why it's wrong here
When a user or application retrieves an S3 object encrypted with a KMS key, S3 acts as an intermediary, requesting decryption from KMS on behalf of the *caller*. Therefore, the principal requiring `kms:Decrypt` permission is the IAM role or user making the S3 `GetObject` request, not the S3 service principal (`s3.amazonaws.com`). Granting `kms:Decrypt` to the S3 service principal in the KMS key policy is incorrect and will not enable the actual caller to decrypt the data.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.