SCS-C02 Question 409
Single answerAn organization is using AWS KMS to encrypt sensitive data stored in their S3 buckets. They have created a symmetric CMK (Customer Master Key) in AWS KMS for this purpose. A compliance requirement now mandates that certain users should only be able to decrypt the data but not encrypt new data using the same key. How can this requirement be achieved?
- A
Attach a key policy to the CMK that includes only the 'kms:Decrypt' action in the allowed permissions for those users.
- B
Enable automatic key rotation for the CMK to limit the access to encryption operations.
- C
Create a new asymmetric CMK with separate encrypt and decrypt permissions, and assign the users decrypt-only access to this key.
- D
Use an S3 bucket policy to restrict encryption actions while allowing decryption actions for the same key.
Show answer and explanation
Correct answer: A
Explanation
AWS KMS key policies are the primary mechanism for managing permissions to use Customer Master Keys. In this scenario, a key policy can be configured to grant 'kms:Decrypt' permissions to specific users while omitting permissions for 'kms:Encrypt' or other actions. This ensures compliance with the requirement that users can decrypt data but not encrypt new data.
- A. Correct.
This is the correct approach. AWS KMS key policies can be configured to provide granular permissions for specific actions, such as 'kms:Decrypt', without granting 'kms:Encrypt' or other permissions.
- B. Incorrect.
Enabling automatic key rotation has no impact on the ability to manage permissions for encryption or decryption operations. It only ensures that the CMK's backing key is rotated periodically.
- C. Incorrect.
Asymmetric CMKs are not required in this scenario, as symmetric CMKs already support granular permissions. Creating a new asymmetric CMK is unnecessary and does not address the compliance requirement directly.
- D. Incorrect.
S3 bucket policies control access to S3 resources but cannot directly restrict specific AWS KMS key actions like encryption or decryption. Key policies are the correct mechanism for this scenario.