DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Add a bucket policy that denies s3:GetObject unless the request uses a specific IAM role.

  Why it's wrong here

  A bucket policy controls access to S3 objects themselves, determining who can perform actions like s3:GetObject or s3:PutObject. While it can restrict *who* can retrieve an encrypted object from S3, it does not govern the permissions required to *decrypt* that object using AWS KMS. An authorized principal could still retrieve the encrypted data, but without explicit kms:Decrypt permission, they would receive ciphertext, not plaintext. Therefore, this policy alone does not enforce decryption restrictions.

• ✓

  Add a key policy that allows the IAM role to perform kms:Decrypt and denies all other principals.

  Why this is correct

  A KMS key policy is the primary and mandatory control mechanism for defining who can use a Customer Master Key (CMK) for cryptographic operations, including kms:Decrypt. By explicitly allowing kms:Decrypt for the specified IAM role and implementing a default deny for all other principals, this policy directly enforces that only the designated role possesses the necessary permission to decrypt data encrypted with this specific KMS key. This ensures granular control over the sensitive data's accessibility in plaintext form.

• ✗

  Configure the S3 bucket with default encryption using the KMS key.

  Why it's wrong here

  Configuring S3 default encryption with a KMS key ensures that all new objects uploaded to the bucket are automatically encrypted at rest using that specified key. While this is a crucial security measure for data protection, it solely addresses the encryption aspect, guaranteeing data is stored in an encrypted state. It does not, however, define or restrict *who* is authorized to perform the kms:Decrypt operation on the data encrypted by that key. Without explicit decryption permissions, any principal with S3 GetObject access could retrieve the encrypted object but would be unable to read its contents.

• ✗

  Create an IAM policy that grants kms:Decrypt only to the specific role.

  Why it's wrong here

  An IAM policy grants permissions to an IAM principal (like a role) within an AWS account. While granting kms:Decrypt in an IAM policy is necessary, it is not sufficient on its own for accessing a KMS key. AWS KMS employs a two-layer authorization model: both the IAM policy *and* the KMS key policy must explicitly permit the action. If the KMS key policy does not also allow the IAM role to perform kms:Decrypt, the request will be denied, regardless of what the IAM policy states.