ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified Security - Specialty All Questions

View all questions & answers for the AWS Certified Security - Specialty exam
Go to Exam

Exam AWS Certified Security - Specialty topic 1 question 413 discussion

Exam question from Amazon's AWS Certified Security - Specialty
Question #: 413
Topic #: 1
[All AWS Certified Security - Specialty Questions]

An IAM user receives an Access Denied message when the user attempts to access objects in an Amazon S3 bucket. The user and the S3 bucket are in the same AWS account. The S3 bucket is configured to use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt all of its objects at rest by using a customer managed key from the same AWS account. The S3 bucket has no bucket policy defined. The IAM user has been granted permissions through an IAM policy that allows the kms:Decrypt permission to the customer managed key. The IAM policy also allows the s3:List* and s3:Get* permissions for the S3 bucket and its objects.

Which of the following is a possible reason that the IAM user cannot access the objects in the S3 bucket?

  • A. The IAM policy needs to allow the kms:DescribeKey permission.
  • B. The S3 bucket has been changed to use the AWS managed key to encrypt objects at rest.
  • C. An S3 bucket policy needs to be added to allow the IAM user to access the objects.
  • D. The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key.
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️
by AdamWest at Nov. 23, 2022, 2:17 a.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
Balki
Highly Voted 2 years, 4 months ago
Selected Answer: D
Agree with D https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-access-default-encryption/
upvoted 7 times
AzureDP900
2 years, 2 months ago
yes, It is D
upvoted 2 times
...
...
kejam
Most Recent 1 year, 5 months ago
Selected Answer: D
https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html#key-policy-default-allow-root-enable-iam
upvoted 1 times
...
task_7
2 years, 1 month ago
Selected Answer: A
The minimum permissions required to download a file from an S3 bucket encrypted with SSE-KMS CMK are: s3:GetObject - This permission allows you to download the object from the S3 bucket. kms:Decrypt - This permission allows you to decrypt the data key that is used to encrypt the object. kms:DescribeKey - This permission allows you to retrieve metadata about the CMK, such as the key policy and key state
upvoted 1 times
task_7
2 years, 1 month ago
My bad look like Decrypt is good enough
upvoted 2 times
...
...
piter8111
2 years, 5 months ago
Selected Answer: D
D. The possible reason for access denied is not having correct permission in KMS resource policy.
upvoted 2 times
...
Isaias
2 years, 5 months ago
Selected Answer: D
it has a iam policy to grant the s3 so it does not need the bucket policy because it says "The user and the S3 bucket are in the same AWS account." , I think the problem is with the key policy so a select D, https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html No AWS principal, including the account root user or key creator, has any permissions to a KMS key unless they are explicitly allowed, and never denied, in a key policy, IAM policy, or grant.
upvoted 3 times
...
tainh
2 years, 5 months ago
Selected Answer: D
i think D is correct S3 use default policy, so resouce owner can access bucket (same AWS Account) https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-policy.html May be KMS key policy don't grant IAM user permission to access KMS https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-access-default-encryption/
upvoted 3 times
...
Sreeprasad
2 years, 5 months ago
D. The possible reason for access denied is not having correct permission in KMS resource policy. C is not the answer. Bucket and IAM user is in the same account and iam policy already granted permissions
upvoted 1 times
...
kerar
2 years, 5 months ago
Selected Answer: C
The bucket policy in Account A must grant access to Account B. https://aws.amazon.com/premiumsupport/knowledge-center/cross-account-access-denied-error-s3/
upvoted 1 times
speedster
2 years, 5 months ago
both are in same account in this question
upvoted 1 times
...
Isaias
2 years, 5 months ago
It says "The user and the S3 bucket are in the same AWS account." I think the problem is with the key policy so a select D, https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html No AWS principal, including the account root user or key creator, has any permissions to a KMS key unless they are explicitly allowed, and never denied, in a key policy, IAM policy, or grant.
upvoted 1 times
...
...
AdamWest
2 years, 5 months ago
Selected Answer: C
C - By default, all Amazon S3 buckets and objects are private. Only the resource owner which is the AWS account that created the bucket can access that bucket. The resource owner can, however, choose to grant access permissions to other resources and users. One way to do this is to write an access policy.
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago