SCS-C03 · Question #7
A security team manages a company's AWS Key Management Service (AWS KMS) customer managed keys. Only members of the security team can administer the KMS keys. The company's application team has a…
The correct answer is C. Create a key grant to allow the application team to use the KMS keys. Revoke the grant when the. AWS KMS key grants are specifically designed to provide temporary, granular permissions to use customer managed keys without modifying key policies. According to the AWS Certified Security - Specialty Study Guide, grants are the preferred mechanism for delegating key usage…
Question
A security team manages a company's AWS Key Management Service (AWS KMS) customer managed keys. Only members of the security team can administer the KMS keys. The company's application team has a software process that needs temporary access to the keys occasionally. The security team needs to provide the application team's software process with access to the keys. Which solution will meet these requirements with the LEAST operational overhead?
Options
- AExport the KMS key material to an on-premises hardware security module (HSM). Give the
- BEdit the key policy that grants the security team access to the KMS keys by adding the application
- CCreate a key grant to allow the application team to use the KMS keys. Revoke the grant when the
- DCreate a new KMS key by generating key material on premises. Import the key material to AWS
How the community answered
(35 responses)- A3% (1)
- B6% (2)
- C80% (28)
- D11% (4)
Explanation
AWS KMS key grants are specifically designed to provide temporary, granular permissions to use customer managed keys without modifying key policies. According to the AWS Certified Security - Specialty Study Guide, grants are the preferred mechanism for delegating key usage permissions to AWS principals for short-term or programmatic access scenarios. Grants allow permissions such as Encrypt, Decrypt, or GenerateDataKey and can be created and revoked dynamically. Using a key grant avoids the operational risk and overhead of editing key policies, which are long- term control mechanisms and should remain stable. AWS documentation emphasizes that frequent key policy changes increase the risk of misconfiguration and accidental privilege escalation. Grants can be revoked immediately when access is no longer required, ensuring strong adherence to the principle of least privilege. Options A and D violate AWS security best practices because AWS KMS does not allow direct export of key material unless the key was explicitly created as an importable key, and exporting key material increases exposure risk. Option B requires manual policy changes and rollback, which introduces operational overhead and audit complexity. AWS recommends key grants as the most efficient and secure way to provide temporary access to KMS keys for applications.
Topics
Community Discussion
No community discussion yet for this question.