DVA-C02 · Question #568
A developer has an application that runs in AWS Account A. The application must retrieve an AWS Secrets Manager secret that is encrypted by an AWS Key Management Service (AWS KMS) key from AWS…
The correct answer is A. kms:Decrypt and kms:DescribeKey. In this scenario, the application in AWS Account A needs to retrieve a secret that is encrypted using a KMS key in AWS Account B. The application's role has the necessary permissions to access the secret in Account B (via Secrets Manager). However, since the secret is encrypted…
Question
A developer has an application that runs in AWS Account A. The application must retrieve an AWS Secrets Manager secret that is encrypted by an AWS Key Management Service (AWS KMS) key from AWS Account B. The application's role has permissions to access the secret in Account B. The developer must add a statement to the KMS key's key policy to allow the role in Account A to use the KMS key in Account B. The permissions must grant least privilege access to the role. Which permissions will meet these requirements?
Options
- Akms:Decrypt and kms:DescribeKey
- Bsecretsmanager:DescribeSecret and secretsmanager:GetSecretValue
- Ckms:*
- Dsecretsmanager:*
How the community answered
(38 responses)- A74% (28)
- B3% (1)
- C8% (3)
- D16% (6)
Explanation
In this scenario, the application in AWS Account A needs to retrieve a secret that is encrypted using a KMS key in AWS Account B. The application's role has the necessary permissions to access the secret in Account B (via Secrets Manager). However, since the secret is encrypted using KMS, the role also needs the appropriate permissions on the KMS key in Account B to decrypt the secret. kms:Decrypt: This permission is required to decrypt data that is encrypted with a specific KMS key. In this case, the application needs the ability to decrypt the secret that is stored in Secrets Manager and encrypted with the KMS key in Account B. kms:DescribeKey: This permission allows the role to describe the KMS key, which can be useful for getting information about the key, such as its status. However, for the specific use case of accessing and decrypting the secret, this permission is sufficient. Together, these two permissions--kms:Decrypt and kms:DescribeKey--ensure that the role can perform the necessary operations (decryption) on the KMS key while following the principle of least privilege.
Community Discussion
No community discussion yet for this question.