A company uses two AWS accounts: production and development. The company stores data in an Amazon S3 bucket that is in the production account. The data is encrypted with an AWS Key Management Service

Question

Options

• AReplicate the customer managed KMS key from the production account to the development
• BCreate a new customer managed KMS key in the development account. Specify the production
• CCreate a new AWS managed KMS key for Amazon S3 in the development account. Specify the
• DReplicate the default AWS managed KMS key for Amazon S3 from the production account to the

• A
  3% (1)
• B
  76% (25)
• C
  6% (2)
• D
  15% (5)

Explanation

Option B is correct because customer managed KMS keys in the development account support custom key policies, which can explicitly grant principals from the production account permission to use the key - this is exactly what's needed to encrypt data being copied cross-account.

A is wrong because KMS keys cannot be replicated or exported between accounts; they are bound to the account and region where they were created.

C is wrong because AWS managed keys (like aws/s3) do not allow modification of their key policies, so you cannot grant cross-account access to them - only customer managed keys support that.

D is wrong for both reasons above: AWS managed keys cannot be replicated, and even if they could, their policies are not modifiable to permit cross-account use.

Memory tip: Think "Customer Managed = Customizable." Only customer managed KMS keys let you edit the key policy to add external account principals. Whenever a question involves cross-account KMS access, the answer will always involve a customer managed key with an updated key policy.

No community discussion yet for this question.