SOA-C02 · Question #631
A company has an Amazon S3 bucket that is encrypted by an AWS Key Management Service (AWS KMS) customer managed key. The KMS key has an alias of DataKey. A SysOps administrator is creating the followi
The correct answer is C. "kms:ListAliases",. For read-only access to S3 objects encrypted with a KMS customer managed key, data engineers only need permission to decrypt the objects and view the key metadata. Allowing the actions kms:Decrypt and kms:DescribeKey is sufficient. Including kms:ListAliases can also be useful if
Question
A company has an Amazon S3 bucket that is encrypted by an AWS Key Management Service (AWS KMS) customer managed key. The KMS key has an alias of DataKey. A SysOps administrator is creating the following key policy to grant permissions to data engineers to read data from the S3 bucket:
The SysOps administrator must complete the Action element of the key policy to provide least privilege read access to objects in the S3 bucket. Which set of actions should the SysOps administrator add to the key policy to meet these requirements?
Options
- A"kms:ReEncrypt*",
- B"kms:ListAliases",
- C"kms:ListAliases",
- D"kms:Update*",
How the community answered
(29 responses)- A3% (1)
- B10% (3)
- C83% (24)
- D3% (1)
Explanation
For read-only access to S3 objects encrypted with a KMS customer managed key, data engineers only need permission to decrypt the objects and view the key metadata. Allowing the actions kms:Decrypt and kms:DescribeKey is sufficient. Including kms:ListAliases can also be useful if the alias is being used to reference the key, as it allows resolution of the alias to the key This minimal set of actions - kms:ListAliases, kms:DescribeKey, and kms:Decrypt - provides the least privilege necessary to read data from the S3 bucket.
Topics
Community Discussion
No community discussion yet for this question.