ExamPark
Course menuDVA-C03

Exams / DVA-C03 / Encryption with AWS KMS / Question 3

DVA-C03 practice question: Encryption with AWS KMS (3 of 3)

Security A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A Lambda function in the same account as an S3 bucket uploads reports and later downloads them.

The bucket's default encryption is SSE-KMS with a customer managed key whose key policy lets IAM policies grant access. The function's execution role allows s3:PutObject and s3:GetObject on the bucket, yet both operations fail with AccessDenied.

Which TWO KMS permissions should be added to the role, scoped to that key, to fix this with least privilege? (Choose two.)

Choose two answers.

  1. A. kms:Encrypt, so S3 can encrypt each uploaded object directly with the KMS key.
  2. B. kms:GenerateDataKey, so S3 can obtain a data key to encrypt each uploaded object.
  3. C. kms:Decrypt, so S3 can decrypt the stored data key when an object is downloaded.
  4. D. kms:ReEncrypt*, so S3 can switch each object's data key to a different KMS key on download.
  5. E. kms:DescribeKey, so S3 can check that the key is enabled before each upload.
Show the answer and explanation

Answers: B, C

  • A. Wrong: S3 does not send object data to KMS. It asks KMS for a data key and encrypts the object itself, so kms:Encrypt is not what an SSE-KMS upload needs. Learn more: Using SSE-KMS (opens in a new tab)
  • B. Right: Correct. Uploading an object with SSE-KMS requires kms:GenerateDataKey on the key, because S3 encrypts each object with a data key that KMS generates under the KMS key. Learn more: Using SSE-KMS (opens in a new tab)
  • C. Right: Correct. Downloading an SSE-KMS object requires kms:Decrypt on the key, so S3 can recover the object's data key. Multipart uploads need both kms:GenerateDataKey and kms:Decrypt. Learn more: Using SSE-KMS (opens in a new tab)
  • D. Wrong: ReEncrypt is used to move ciphertext from one KMS key to another, which neither a plain upload nor a download does. It would also be broader than the task requires.
  • E. Wrong: The S3 documentation lists kms:GenerateDataKey for uploads and kms:Decrypt for downloads. DescribeKey reads key metadata and would not fix the AccessDenied errors.

Explanation

With SSE-KMS, S3 asks KMS for a data key to encrypt each uploaded object and later asks KMS to decrypt that data key on download. The caller therefore needs kms:GenerateDataKey for uploads and kms:Decrypt for downloads, and both for multipart uploads. Permissions such as Encrypt, ReEncrypt* and DescribeKey are not what these operations use.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice Encryption with AWS KMSAll Encryption with AWS KMS questions

Want more on Encryption with AWS KMS? The 5 full-length practice sets have 16 more Encryption with AWS KMS questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets