SAA-C03 Design Secure Architectures Practice Question
An application in Account B (IAM role arn:aws:iam::account-b:role/app-read) reads objects from an S3 bucket in Account A. The bucket uses SSE-KMS with a customer-managed KMS key in Account A. Object reads consistently fail with an error that includes "AccessDenied" and "kms:Decrypt".
The IAM permissions in Account B for kms:Decrypt are correct, but the requests still fail.
Which change will most directly fix the failure?
⚠ Common exam trap
Many candidates assume IAM permissions alone are sufficient for cross-account KMS operations, forgetting that KMS key policies are resource-based and must explicitly allow external principals, even when the IAM role has the correct permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the KMS key policy in Account A to allow kms:Decrypt for the Account B role arn:aws:iam::account-b:role/app-read, using the appropriate cross-account conditions (for example, allowing the use via S3 and the expected encryption context for the bucket).
When using SSE-KMS with a customer-managed KMS key in a cross-account scenario, the KMS key policy must explicitly grant the external IAM role (arn:aws:iam::account-b:role/app-read) permission to perform kms:Decrypt. Even if the IAM role in Account B has the correct kms:Decrypt permission, the KMS key policy in Account A acts as a resource-based policy that must also allow the cross-account principal. Without this, the KMS service denies the decrypt request, resulting in the 'AccessDenied' error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add kms:Decrypt to the KMS key policy in Account A for the Account B role arn:aws:iam::account-b:role/app-read, and remove kms:Decrypt from the role policy in Account B.
Why it's wrong here
Adding kms:Decrypt to the KMS key policy is a valid approach, but removing kms:Decrypt from the role policy is not required to fix an AccessDenied kms:Decrypt failure. KMS authorization requires both (1) identity policy permission (in Account B) and (2) the KMS key policy permission (in Account A). Removing the role permission can cause the failure to continue or move to a different authorization denial.
When this WOULD be correct
This option would be correct if the question stated that the role in Account B had kms:Decrypt permissions but the key policy in Account A was overly permissive, and the goal was to restrict access by removing the permission from the role and relying solely on the key policy to grant cross-account access.
- ✗
Update the IAM role in Account B to use the s3:GetObject permission only, and rely on S3 to authorize KMS decrypt automatically.
Why it's wrong here
S3 authorization to call GetObject does not eliminate the need for KMS permissions to call kms:Decrypt. For SSE-KMS, the GetObject request ultimately requires kms:Decrypt in KMS, which is authorized by both the caller’s IAM permissions and the KMS key policy.
When this WOULD be correct
In a scenario where the S3 bucket uses SSE-S3 (not SSE-KMS) and the IAM role in Account B has s3:GetObject permission, then no KMS permissions are needed, and S3 handles decryption automatically.
- ✓
Modify the KMS key policy in Account A to allow kms:Decrypt for the Account B role arn:aws:iam::account-b:role/app-read, using the appropriate cross-account conditions (for example, allowing the use via S3 and the expected encryption context for the bucket).
Why this is correct
For SSE-KMS, S3 must call KMS Decrypt when serving objects. KMS authorization is evaluated against the KMS key policy in Account A in addition to the identity policy in Account B. If the error includes kms:Decrypt AccessDenied in a cross-account scenario, the most direct fix is to update the KMS key policy to allow the Account B role to use the key for decrypt (often with conditions tied to S3 usage and the specific bucket/object encryption context).
- ✗
Switch the S3 bucket encryption from SSE-KMS to SSE-S3, keeping all existing IAM and KMS configuration unchanged.
Why it's wrong here
Changing to SSE-S3 avoids KMS decryption entirely, so it could remove the kms:Decrypt failure. However, that is not a targeted fix for the underlying authorization issue and conflicts with the stated requirement of using the existing customer-managed KMS key for SSE-KMS.
When this WOULD be correct
This option would be correct if the question described a scenario where the application does not require KMS-based encryption, the bucket's encryption can be changed without affecting other dependencies, and the goal is to eliminate KMS-related permissions entirely to simplify access.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.
✓Modify the KMS key policy in Account A to allow kms:Decrypt for the Account B role arn:aws:iam::account-b:role/app-read, using the appropriate cross-account conditions (for example, allowing the use via S3 and the expected encryption context for the bucket).Correct answer▾
Why this is correct
For SSE-KMS, S3 must call KMS Decrypt when serving objects. KMS authorization is evaluated against the KMS key policy in Account A in addition to the identity policy in Account B. If the error includes kms:Decrypt AccessDenied in a cross-account scenario, the most direct fix is to update the KMS key policy to allow the Account B role to use the key for decrypt (often with conditions tied to S3 usage and the specific bucket/object encryption context).
✗Add kms:Decrypt to the KMS key policy in Account A for the Account B role arn:aws:iam::account-b:role/app-read, and remove kms:Decrypt from the role policy in Account B.Wrong answer — click to see why▾
Why this is wrong here
The error indicates that the KMS key policy in Account A does not grant the Account B role permission to decrypt. Adding kms:Decrypt to the key policy is necessary, but removing it from the role policy in Account B is incorrect because the role still needs the permission for the request to proceed; both the key policy and the role policy must allow the action.
★ When this WOULD be the correct answer
This option would be correct if the question stated that the role in Account B had kms:Decrypt permissions but the key policy in Account A was overly permissive, and the goal was to restrict access by removing the permission from the role and relying solely on the key policy to grant cross-account access.
Why candidates choose this
Candidates may think that removing the permission from the role simplifies the configuration or that the key policy alone is sufficient, misunderstanding that both the key policy and the IAM policy must grant the permission for cross-account access.
✗Update the IAM role in Account B to use the s3:GetObject permission only, and rely on S3 to authorize KMS decrypt automatically.Wrong answer — click to see why▾
Why this is wrong here
The error includes 'kms:Decrypt', indicating the KMS key policy is missing cross-account decrypt permission. Simply using s3:GetObject does not bypass KMS authorization; S3 cannot automatically authorize KMS decrypt across accounts without proper key policy.
★ When this WOULD be the correct answer
In a scenario where the S3 bucket uses SSE-S3 (not SSE-KMS) and the IAM role in Account B has s3:GetObject permission, then no KMS permissions are needed, and S3 handles decryption automatically.
Why candidates choose this
Candidates may think S3 handles all authorization automatically, overlooking that cross-account KMS access requires explicit key policy grants, not just IAM permissions.
✗Switch the S3 bucket encryption from SSE-KMS to SSE-S3, keeping all existing IAM and KMS configuration unchanged.Wrong answer — click to see why▾
Why this is wrong here
Switching to SSE-S3 removes KMS involvement, but the question states that the bucket uses SSE-KMS with a customer-managed key. Changing encryption type is an indirect workaround that does not address the root cause (missing KMS key policy permissions) and may violate compliance or security requirements.
★ When this WOULD be the correct answer
This option would be correct if the question described a scenario where the application does not require KMS-based encryption, the bucket's encryption can be changed without affecting other dependencies, and the goal is to eliminate KMS-related permissions entirely to simplify access.
Why candidates choose this
Candidates may think that switching to SSE-S3 removes the KMS dependency and thus the error, without considering that the bucket is already configured with SSE-KMS and changing encryption type is a significant change that may not be allowed or desired.
Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.