Use a customer managed KMS key for S3 encryption.
Allow only a specific IAM role to encrypt and decrypt.
Which setting is most appropriate?
Use the KMS key policy together with an IAM policy to restrict the role and cryptographic actions.
Detailed explanation
Both the key resource policy and the role's IAM permissions can limit cryptographic operations.
Both the key resource policy and the role's IAM permissions can limit cryptographic operations.
A hidden name does not restrict KMS key usage.
A hidden name does not restrict KMS key usage.
Knowing a key ARN does not grant or restrict key permissions.
Knowing a key ARN does not grant or restrict key permissions.
A signed URL authenticates CDN content delivery, not KMS API calls.
A signed URL authenticates CDN content delivery, not KMS API calls.
Check official documentation
Compare the following points with the official documentation.
AWS KMS key policies and IAM policiesの公式説明を確認する。
What to confirm
KMSキーのリソースポリシーとIAMポリシーを組み合わせられる。
Key points
- KMS key policy
- Encrypt and decrypt
- IAM role
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Two policy layers
The key policy and IAM policy must allow the operation for a typical role-based use case.
Least privilege
Limit principals, actions, resources, and conditions to the required encryption flow.