SCS-C02 Question 358
Select 2An organization is using AWS Key Management Service (AWS KMS) to encrypt sensitive data stored in Amazon S3. The security team wants to ensure that only specific IAM roles within the organization can decrypt the data using the KMS key. Additionally, they want to prevent any accidental deletion or unauthorized modifications of the KMS key. Which combination of steps should the organization take to meet these requirements?
- A
Use KMS key policies to explicitly allow access only to the specific IAM roles and deny access to all other principals.
- B
Enable AWS CloudTrail to log all KMS API calls and monitor who is accessing the KMS key.
- C
Use an S3 bucket policy to restrict access to the bucket based on the specific IAM roles.
- D
Enable key deletion protection on the KMS key to prevent accidental deletion.
- E
Create a Service Control Policy (SCP) to block all KMS key-related actions for unauthorized accounts.
Show answer and explanation
Correct answers: A, D
Explanation
To ensure that only specific IAM roles can decrypt the data using the KMS key, the organization should use KMS key policies to explicitly define access control. To prevent accidental deletion of the KMS key, enabling key deletion protection is necessary. These steps directly address the scenario's requirements for access control and key protection. Other options either do not directly address the requirements or provide supplementary but non-essential solutions.
- A. Correct.
Using KMS key policies is the recommended way to define and enforce fine-grained access control for specific IAM roles to a KMS key. This ensures that only authorized roles can decrypt the data.
- B. Incorrect.
While enabling AWS CloudTrail provides visibility into KMS API calls, it does not enforce access control or prevent accidental deletion of the KMS key. This step is useful for monitoring, not for directly restricting access.
- C. Incorrect.
S3 bucket policies control access to the S3 bucket but cannot enforce access to the KMS key itself. The question specifically requires controlling access to the KMS key, not the bucket.
- D. Correct.
Enabling key deletion protection prevents accidental deletion of the KMS key, aligning with the organization's requirement to safeguard the key.
- E. Incorrect.
Service Control Policies (SCPs) are used to manage permissions at the account or organizational unit level in AWS Organizations. While they can block unwanted actions, they are not the most effective solution for fine-grained KMS key access control.