Account 111111111111 owns a symmetric customer managed AWS KMS key.
A Lambda function in account 222222222222 must call kms:Decrypt on data keys that were encrypted under this key, but the call is denied. The key's policy currently allows only principals in account 111111111111, and the security team wants to avoid long-term credentials.
Which TWO actions are required? (Choose two.)
Choose two answers.
AA. Add a key policy statement in account 111111111111 that allows account 222222222222 to use kms:Decrypt.
BB. Add account 222222222222 as a key administrator in the key policy so that its IAM policies can use the key.
CC. Allow kms:Decrypt on the key's full ARN in the IAM policy of the function's execution role in account 222222222222.
DD. Turn on automatic key rotation so that KMS creates a copy of the key material in account 222222222222.
EE. Create an IAM user in account 111111111111 with kms:Decrypt and store its access key in the function's environment variables.
Show the answer and explanation
Answers: A, C
A. Right: Correct. The key policy is the main control over a KMS key, so another account is allowed to use the key only if the policy names it. The policy decides who can be given access; it does not yet give any role in the other account access. Learn more: Allowing users in other accounts to use a KMS key (opens in a new tab)
B. Wrong: Key administrators can manage a key, for example change its policy, but the default policy does not let them use it for cryptographic operations. Administrator status is not how another account is given use of a key. Learn more: Default key policy (opens in a new tab)
C. Right: Correct. For cross-account use, the key policy and an IAM policy in the calling account must both allow the action. The IAM policy is what gives this particular role access, and it must use the full key ARN because a key ID is assumed to be in the caller's own account. Learn more: Allowing users in other accounts to use a KMS key (opens in a new tab)
D. Wrong: Rotation replaces the key material of a key in its own account on a schedule. It never copies the key or shares it with another account.
E. Wrong: This would work technically, but it relies on a long-term access key stored in the function's configuration. Cross-account use of the key is normally granted through the key policy and the caller's own IAM role.
Explanation
Cross-account KMS access needs two permissions: the key policy in the key's account must allow the other account, and an IAM policy in the calling account must allow the action on the full key ARN. Neither alone is enough. Key administrators, key rotation and stored access keys are not how a Lambda role in another account gets use of the key.
Want more on Encryption with AWS KMS? The 5 full-length practice sets have 16 more Encryption with AWS KMS questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →