Exams / DVA-C02 / Encryption with AWS KMS / Question 3
DVA-C02 practice question: Encryption with AWS KMS (3 of 3)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
An S3 bucket uses default encryption with SSE-KMS and a customer managed key. A Lambda function's execution role allows s3:PutObject and s3:GetObject on the bucket, but uploads and downloads both fail with AccessDenied. The key policy lets IAM policies in the account grant access. Which TWO permissions on the key should be added to the execution role? (Choose two.)
Choose two answers.
- AA. kms:CreateGrant
- BB. kms:ScheduleKeyDeletion
- CC. kms:GenerateDataKey
- DD. kms:EnableKeyRotation
- EE. kms:Decrypt
Show the answer and explanation
Answers: C, E
- A. Wrong: Grants let other principals use a key. S3 does not need the function to create grants for normal uploads and downloads.
- B. Wrong: This is a key administration action for deleting a key, and has nothing to do with using it for S3 objects.
- C. Right: Correct. S3 asks KMS for a data key when an object is uploaded with SSE-KMS, so the uploader needs this permission.
- D. Wrong: Rotation is a key management setting. It does not allow the role to encrypt or decrypt objects.
- E. Right: Correct. Downloading an SSE-KMS object needs kms:Decrypt so that S3 can decrypt the object's data key.
Explanation
With SSE-KMS, S3 calls KMS on the caller's behalf. A PutObject needs kms:GenerateDataKey, a GET needs kms:Decrypt, and a multipart upload needs both. S3 permissions alone are not enough when objects are encrypted with a customer managed key.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.