An AI application processes encrypted data.
Give its runtime role only required key operations and trace use.
Choose two appropriate designs.
Limit KMS operations and key resources to the runtime role, monitor use and policy changes, and avoid embedding long-lived key secrets.
Detailed explanation
Key access itself must be protected and audited.
Encrypted data can be processed with least privilege.
A leak can enable broad decryption.
Unauthorized use and excessive access can be detected.
Check official documentation
Compare the following points with the official documentation.
AWS KMS公式のキーポリシー、IAM、CloudTrailとAIF-C01 Domain 5.1を確認する。
Official references
What to confirm
暗号化だけでなく鍵操作の最小権限と監査を設計できる。
Key points
- KMS
- Least privilege
- Audit
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
KMS key policy
A resource policy that controls which principals may use or administer a KMS key.
Least privilege
Granting only the actions, resources, and conditions required for a task.