Exam AWS Certified Security - Specialty topic 1 question 267 discussion

B&D B. Verify that KMSUser has no explicit denies for the GenerateDataKey action in its attached IAM policies. If the user already has the GenerateDataKey permission in IAM, and no explict deny, then he should have permission - check out the diagram https://docs.aws.amazon.com/kms/latest/developerguide/policy-evaluation.html D. Ensure that KMSUser is including the encryption context key-value pair in its GenerateDataKey. If you submit the encryption context value in the encryption operation, you are required to pass it in the corresponding decryption operation. You can use the encryption context inside your policies to enforce tighter controls for your encrypted resources. https://docs.aws.amazon.com/whitepapers/latest/kms-best-practices/encryption-context.html

B and C

Correct answers are BD. Ensure there is no explicit deny (in the user IAM policy). Ensure user uses the encryption context key-value pair.

I think B is valid if the key is in the same account as 111122223333. However it is not mentioned. If in different accounts, B is wrong and C is correct.

B and D C. There is "allow" in source policy, no "allow" is required on the principal side. Only need to make sure there is no explicit "Deny" somewhere else. If the VPC endpoint is involved, there is a need of checking if there is "allow" access through the endpoint policy.

B and D is correct

B&D is correct

B&D is my answer.

B&D is my answer

It is B & D. The Key Policy contains an encryption context condition, so that key pair needs to be applied using the --encryption-context [key=value] option

BD is my answer.!

BC as well for me. Check issues with I am policy to see there is no express denial or that authority exist to generate data key.