A company wants to establish separate AWS Key Management Service (AWS KMS) keys to use for different AWS services. The company's security engineer created a key policy to allow the infrastructure…

Question

Options

• AIn the statement block that contains the Sid "Allow use of the key", under the "Condition" block,
• BIn the policy document, remove the statement block that contains the Sid "Enable IAM User
• CIn the statement block that contains the Sid "Allow use of the key", under the "Condition" block,
• DIn the policy document, add a new statement block that grants the kms:Disable* permission to the

• A
  12% (5)
• B
  2% (1)
• C
  81% (35)
• D
  5% (2)

Explanation

AWS KMS key policies can restrict how and where a key is used by leveraging condition keys such as kms:ViaService. According to the AWS Certified Security - Specialty documentation, kms:ViaService limits key usage to requests that originate from a specific AWS service in a specific Region. If this condition is overly broad or incorrect, other IAM roles and services may unintentionally use the key. By explicitly setting the kms:ViaService condition value to ec2.us-east-1.amazonaws.com, the key policy ensures that the KMS key can only be used when requests are made through the Amazon EC2 service in that Region, such as for EBS volume encryption. This prevents other services or unintended IAM roles from using the key. Option A weakens the condition logic and can broaden access. Option B removes essential permissions that allow IAM policies to function with KMS keys and is not recommended. Option D relates to administrative control of the key, not service-level usage restrictions. AWS best practices recommend using kms:ViaService and precise condition values to enforce service- specific key usage and strong separation of duties.

No community discussion yet for this question.