DVA-C02 Development with AWS Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  {"Effect":"Allow","Action":["kms:Encrypt"],"Resource":"*"}

  Why it's wrong here

  This policy grants permission to encrypt data using AWS KMS. However, the scenario involves a serverless application likely needing to retrieve and process data that has been encrypted with SSE-KMS (Server-Side Encryption with AWS KMS keys). To access such data, the application requires the ability to decrypt it, not encrypt it. Therefore, `kms:Encrypt` is the incorrect action for this purpose, as it would only allow the creation of new encrypted data.

• ✓

  {"Effect":"Allow","Action":["kms:Decrypt"],"Resource":"arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"}

  Why this is correct

  When an object is stored in Amazon S3 using Server-Side Encryption with AWS KMS keys (SSE-KMS), the S3 service encrypts the object data using a unique data key, which is then encrypted by the specified KMS customer master key (CMK). To retrieve and read this object, the calling entity (e.g., a Lambda function) must have explicit `kms:Decrypt` permission on the specific KMS key used for encryption. This allows S3 to use the caller's permissions to request decryption of the data key, enabling the object's content to be returned in plaintext.

• ✗

  {"Effect":"Allow","Action":["kms:GenerateDataKey"],"Resource":"*"}

  Why it's wrong here

  The `kms:GenerateDataKey` action allows an entity to request AWS KMS to generate a unique data key and return both its plaintext and encrypted forms. This action is primarily used when an application wants to perform client-side encryption or when S3 needs to generate a new data key for server-side encryption upon object upload. It does not provide the capability to decrypt an already encrypted data key or the object content, which is necessary for reading SSE-KMS encrypted data.

• ✗

  {"Effect":"Allow","Action":["s3:GetObject"],"Resource":"arn:aws:s3:::my-bucket/*"}

  Why it's wrong here

  While `s3:GetObject` is indeed necessary to retrieve an object from an S3 bucket, it is insufficient on its own when the object is encrypted using Server-Side Encryption with AWS KMS (SSE-KMS). For SSE-KMS encrypted objects, S3 acts on behalf of the requesting principal to interact with AWS KMS. Therefore, in addition to `s3:GetObject`, the principal must also possess the `kms:Decrypt` permission on the specific KMS key used for encryption, allowing S3 to successfully decrypt the object's data key before returning the object.

Go deeper

Related to this question