SAA-C03 Design Secure Architectures Practice Question
An S3 bucket in account A uses default server-side encryption with an AWS KMS customer-managed key (CMK) in account A. A team created an IAM role in account B that is allowed by IAM policy to perform s3:GetObject on the bucket. When the account B role tries to read objects, it fails with: AccessDeniedException: 'User is not authorized to perform kms:Decrypt'. Which change is most likely to fix the issue?
⚠ Common exam trap
A common mix-up: candidates assume IAM permissions in account B are sufficient for cross-account KMS operations, forgetting that the KMS key policy in the owning account must explicitly grant access to the external principal.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the CMK key policy in account A to allow the account B role principal to call kms:Decrypt (and kms:DescribeKey if needed).
When an S3 bucket uses SSE-KMS with a customer-managed key (CMK) in account A, the account B role must have explicit kms:Decrypt permission on that CMK. The key policy in account A controls access to the CMK, so adding the account B role principal to the key policy with kms:Decrypt (and kms:DescribeKey if needed) is required. Without this, even if the S3 bucket policy and IAM role allow s3:GetObject, the KMS decrypt call will fail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add kms:Decrypt permissions to the identity policy in account B only, without modifying the CMK key policy in account A.
Why it's wrong here
Adding kms:Decrypt to an identity policy in Account B only grants the principal *permission to attempt* the action. However, for cross-account access to a KMS Customer Managed Key (CMK), the CMK's key policy in Account A must *also explicitly permit* the Account B principal to use the key. Without this explicit authorization on the resource itself, the request will be denied, as the key policy acts as the ultimate gatekeeper in the two-layer authorization model.
- ✓
Update the CMK key policy in account A to allow the account B role principal to call kms:Decrypt (and kms:DescribeKey if needed).
Why this is correct
Updating the CMK key policy in Account A is the correct approach because KMS key policies are the authoritative resource-based policies that govern access to the key, especially for cross-account scenarios. By explicitly adding the Account B role's ARN as a `Principal` and granting `kms:Decrypt` (and `kms:DescribeKey` for context) within the key policy, Account A explicitly authorizes the external principal to use its CMK, satisfying the two-layer authorization model.
- ✗
Disable SSE-KMS on the S3 bucket so objects use SSE-S3 instead, eliminating the need for KMS permissions.
Why it's wrong here
Disabling SSE-KMS and switching to SSE-S3 would change the encryption mechanism, not resolve the permissions issue for the existing SSE-KMS encrypted objects. This action would remove the requirement for KMS permissions by using an AWS-managed key (SSE-S3), but it would likely violate any security or compliance requirements mandating the use of a customer-managed CMK. It's a functional change that sidesteps the problem rather than fixing the access control for the specified encryption type.
- ✗
Attach a broad permissions boundary to the account B role allowing all kms:* actions to override the key policy.
Why it's wrong here
A permissions boundary defines the *maximum* permissions an IAM identity policy can grant to an IAM principal, but it does not grant permissions itself. Furthermore, permissions boundaries do not override resource-based policies like KMS key policies. Even if a permissions boundary allows `kms:*`, the request will still be denied if the KMS key policy in Account A does not explicitly permit the Account B principal to perform `kms:Decrypt` on that specific key.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAA-C03 question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.