A data account owns the KMS key used for Glue output in a processing account.
The key owner must explicitly control the external principal.
Which protection approach is most appropriate?
Configure the key policy and caller IAM policy for cross-account use, and use a grant when suitable.
Detailed explanation
An identifier is not a permission.
An identifier is not a permission.
Publishing key material would disclose the secret.
Publishing key material would disclose the secret.
Lifecycle manages S3 objects and cannot authorize KMS operations.
Lifecycle manages S3 objects and cannot authorize KMS operations.
Cross-account KMS use requires the key owner and caller permissions to agree.
Cross-account KMS use requires the key owner and caller permissions to agree.
Check official documentation
Compare the following points with the official documentation.
AWS KMS cross-account use、key policy、grants、S3 SSE-KMSの公式説明を確認する。
What to confirm
キーARNの知識だけでは権限にならず、双方の許可が必要なことを説明できる。
Key points
- KMS key policy
- Grant
- Cross-account
- GenerateDataKey
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Ownership
Separate key administration from data use and understand the effect of disabling the key.
Delegation
Use grants for controlled programmatic access and revoke them when no longer needed.