DVA-C02 · Question #767
A developer has created a new IAM user that has the s3:PutObject permission to write to a specific Amazon S3 bucket. The S3 bucket uses server-side encryption with AWS KMS managed keys (SSE-KMS) as…
The correct answer is C. Update the policy of the IAM user to allow the kms:GenerateDataKey action. With SSE-KMS default encryption, Amazon S3 must call AWS KMS on the caller’s behalf to generate a data key for object encryption. The IAM principal uploading the object must be allowed to use the KMS key for this purpose. Granting permission to call KMS data key generation…
Question
A developer has created a new IAM user that has the s3:PutObject permission to write to a specific Amazon S3 bucket. The S3 bucket uses server-side encryption with AWS KMS managed keys (SSE-KMS) as the default encryption. When an application uses the access key and secret key of the IAM user to call the PutObject API operation, the application receives an access denied error. What should the developer do to resolve this error?
Options
- AUpdate the policy of the IAM user to allow the s3:EncryptionConfiguration action.
- BUpdate the bucket policy of the S3 bucket to allow the IAM user to upload objects.
- CUpdate the policy of the IAM user to allow the kms:GenerateDataKey action.
- DUpdate the ACL of the S3 bucket to allow the IAM user to upload objects.
How the community answered
(36 responses)- A8% (3)
- B3% (1)
- C72% (26)
- D17% (6)
Explanation
With SSE-KMS default encryption, Amazon S3 must call AWS KMS on the caller’s behalf to generate a data key for object encryption. The IAM principal uploading the object must be allowed to use the KMS key for this purpose. Granting permission to call KMS data key generation (required for SSE-KMS) resolves the access denied error when using PutObject with default
Community Discussion
No community discussion yet for this question.