SOA-C02 · Question #652
A company is using Amazon EventBridge to deliver events to an Amazon Simple Queue Service (Amazon SQS) queue. The solution was fully functional until the company enabled AWS Key Management Service…
The correct answer is A. "kms:Encrypt". The AWS documentation states that when you use a customermanaged CMK with Amazon EventBridge, the key policy must allow the service principal (events.amazonaws.com) to call the following KMS API operations on the CMK: kms:GenerateDataKey EventBridge uses these two operations…
Question
A company is using Amazon EventBridge to deliver events to an Amazon Simple Queue Service (Amazon SQS) queue. The solution was fully functional until the company enabled AWS Key Management Service (AWS KMS) encryption with a customer managed key on the SQS queue. A SysOps administrator must add KMS permissions to allow EventBridge to publish to the KMS encrypted SQS queue. The SysOps administrator must add the permissions to the Action section of the following KMS encryption key policy:
Which two permissions will allow EventBridge to publish to the KMS encrypted SQS queue?
Exhibit
Options
- A"kms:Encrypt",
- B"kms:Encrypt",
- C"kms:Decrypt",
- D"kms:Decrypt",
How the community answered
(47 responses)- A77% (36)
- B6% (3)
- C13% (6)
- D4% (2)
Explanation
The AWS documentation states that when you use a customermanaged CMK with Amazon EventBridge, the key policy must allow the service principal (events.amazonaws.com) to call the following KMS API operations on the CMK: kms:GenerateDataKey EventBridge uses these two operations when it publishes events to an SQS queue encrypted with a customer-managed key. The Encrypt operation is used to encrypt the event data, and GenerateDataKey is used to create a data key for envelope encryption. Adding these two permissions to the key policy's Action section ensures that EventBridge can successfully publish events to the KMSencrypted SQS queue.
Topics
Community Discussion
No community discussion yet for this question.