Exams / DVA-C02 / Encryption with AWS KMS / Question 2
DVA-C02 practice question: Encryption with AWS KMS (2 of 3)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
Account A owns a customer managed AWS KMS key. A Lambda function in account B must call kms:Decrypt with this key to read data encrypted in account A. Which TWO actions are required? (Choose two.)
Choose two answers.
- AA. Add a statement to the key policy in account A that allows account B to use kms:Decrypt.
- BB. Enable automatic key rotation on the key so that account B receives a copy.
- CC. Allow kms:Decrypt on the key's ARN in the execution role policy in account B, and use that ARN in the code.
- DD. Reference the key in the function's code by its alias name, such as alias/app-key.
- EE. Create an IAM user in account A and store its access keys in the function's configuration.
Show the answer and explanation
Answers: A, C
- A. Right: Correct. The key policy must allow the external account. Without it, no IAM policy in account B can grant use of the key.
- B. Wrong: Rotation changes the key material over time within the same key. It does not share anything with another account.
- C. Right: Correct. Account B must delegate the permission to its role, and calls must name the key by ARN because it lives in another account.
- D. Wrong: An alias name on its own is looked up in the caller's account, so it cannot identify a key in account A.
- E. Wrong: Embedding long-term keys is poor practice and unnecessary when cross-account key policies are available.
Explanation
Cross-account use of a KMS key needs both policies. The key policy in the owning account must allow the external account, and an IAM policy in the external account must delegate those permissions to its users or roles. Neither alone is enough, and the external account must refer to the key by its key ARN or alias ARN.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.