Analysts read encrypted data but must not delete keys or change key policies.
Only key administrators may operate the key lifecycle.
Which protection approach is most appropriate?
Use separate KMS key-administrator and key-user roles with narrowly scoped policies.
Detailed explanation
They could delete keys, change policy, and decrypt all data.
They could delete keys, change policy, and decrypt all data.
Audit history cannot guarantee recovery from key deletion.
Audit history cannot guarantee recovery from key deletion.
Key lifecycle operations and Encrypt/Decrypt operations are assigned to different principals.
Key lifecycle operations and Encrypt/Decrypt operations are assigned to different principals.
Knowledge of an ARN is not authorization.
Knowledge of an ARN is not authorization.
Check official documentation
Compare the following points with the official documentation.
AWS KMS key administrators、key users、key policy、scheduled deletionの公式説明を確認する。
What to confirm
暗号操作権限とキー管理権限を分ける理由を説明できる。
Key points
- Key administrators
- Key users
- Separation of duties
- kms:*
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Least privilege
Grant data users only required Encrypt, Decrypt, or GenerateDataKey actions.
Recovery planning
Test disabled-key, deletion, and region-failure recovery paths with controlled administrators.