Exam AWS Certified Security - Specialty topic 1 question 199 discussion

A and B: https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-access.html

AB are the correct answers.

AB sure.

B. The EC2 instance role does not have read permissions to read the parameters in Parameter Store. If the EC2 instance role lacks the necessary permissions to read the parameters from Parameter Store, the application won't be able to retrieve the secure string values. C. Parameter Store does not have permission to use AWS Key Management Service (AWS KMS) to decrypt the parameter. If Parameter Store doesn't have the required permissions to use AWS KMS to decrypt the secure string parameter, the decryption process will fail, preventing the application from accessing the sensitive data. These issues are related to permissions, and ensuring that the EC2 instance role has the necessary read permissions on Parameter Store and decrypt permissions on the associated AWS KMS key will likely resolve the problem.

A - Assuming a CMK was used B - Yes, access is required. C - Can't be true, as it will always have access to the AWS Managed key, and CMK is an instance permission.

I agree on A and B.

A and B

A and B.

A. The EC2 instance role does not have decrypt permissions on the AWS Key Management Service (AWS KMS) key used to encrypt the secret. B. The EC2 instance role does not have read permissions to read the parameters in Parameter Store.

A B is correct answer

AB for me too.

A&B - we use such solution in our case

A..and B for sure .... https://acloud.guru/forums/aws-certified-security-specialty/discussion/-LkThH4bMnlTseiGTXjM/How%20to%20allow%20EC2%20instances%20access%20to%20SSM%20Parameter%20Store%20with%20SecureString%20using%20default%20KMS%20CMK%3F

AB 100%

Thank you all :)

A. B. ssm: getparameters & kms:decrypt are the two permissions needed.

Do you have prof for A & B DayQuil ?