SAP-C02 kms:ViaService condition Practice Question

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/MyAppRole"
      },
      "Action": "kms:Decrypt",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "s3.us-east-1.amazonaws.com",
          "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::my-bucket/*"
        }
      }
    }
  ]
}

Refer to the exhibit. A solutions architect has attached this key policy to an AWS KMS key. The IAM role MyAppRole is used by an application running on an EC2 instance in us-east-1. The application tries to decrypt an object stored in the S3 bucket my-bucket using server-side encryption with AWS KMS (SSE-KMS). What will happen?

⚠ Common exam trap

The trap is that candidates may assume the key policy's kms:Decrypt permission granted to the root account with a condition automatically allows any IAM role to call KMS Decrypt directly. In reality, the condition restricts the permission to requests made via S3 (kms:ViaService), so direct KMS calls are denied unless the role has an explicit IAM policy granting kms:Decrypt or is listed as a principal in the key policy without the restrictive condition.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The decryption fails if the application calls KMS Decrypt directly instead of letting S3 decrypt.

The key policy includes a condition that limits the `kms:Decrypt` permission to only be allowed when the request comes from Amazon S3 (using `kms:ViaService`). When the application calls KMS Decrypt directly, the request does not come from S3, so the condition is not satisfied, and the decryption fails. The IAM role MyAppRole does not have an IAM policy granting `kms:Decrypt`, and the key policy does not grant it directly to the role. Options A, B, and D are incorrect because the decryption fails only when calling KMS directly, not because of the role's permissions or encryption context.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The decryption fails because the key policy does not grant decrypt to the role.
Why it's wrong here
The key policy does grant decrypt, but with conditions.
✗
The decryption succeeds because the role has permissions via this key policy.
Why it's wrong here
The condition restricts the permission to requests coming via S3 service.
✓
The decryption fails if the application calls KMS Decrypt directly instead of letting S3 decrypt.
Why this is correct
The condition kms:ViaService requires the request to come from S3, not direct SDK call.
✗
The decryption succeeds only if the object was uploaded with the correct encryption context.
Why it's wrong here
Even with correct context, the viaService condition must be met.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

SAP-C02 kms:ViaService condition Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

AWS S3 Storage Class Comparison

Related to this question