Q25 — AWS SAA-C03 Ch.10

Question 25 of 100 | ← Chapter 10

Q625. A company is using AWS Key Management Service (AWS KMS) customer master keys (CMKs) to encrypt AWS Lambda environment variables. A solutions architect needs to ensure that the required permissions are in place to decrypt and use the environment variables. Which steps must the solutions architect take to implement the correct permissions? (Select TWO.)

Correct Answer: B. Add AWS KMS permissions in the Lambda execution role., D. Allow the Lambda execution role in the AWS KMS key policy

Explanation

To implement the correct permissions for decrypting and using AWS Lambda environment variables encrypted with AWS Key Management Service (AWS KMS) customer master keys (CMKs), the solutions architect must take the following steps:B. Add AWS KMS permissions in the Lambda execution role.D. Allow the Lambda execution role in the AWS KMS key policy. B. Adding AWS KMS permissions in the Lambda execution role allows the Lambda function to access the necessary AWS KMS operations to decrypt the environment variables. This ensures that the Lambda function has the required permissions to use the CMK for decryption. D. Allowing the Lambda execution role in the AWS KMS key policy grants the necessary permissions to the Lambda function's execution role to use the CMK. This allows the Lambda function to decrypt the environment variables encrypted with the CMK.Option A is not the best choice:A. Adding AWS KMS permissions in the Lambda resource policy is not necessary for granting permissions to decrypt and use environment variables. The Lambda resource policy is typically used to control access to the Lambda function itself, not for permission management of resources used by the Lambda function.Option C is not the best choice either:C. Adding AWS KMS permissions in the Lambda function policy is not a valid option as there is no specific Lambda function policy that controls AWS KMS access. Lambda function policies are used to define permissions for invoking the Lambda function, not for managing AWS KMS permissions.Option E is not the best choice either:E. Allowing the Lambda resource policy in the AWS KMS key policy is not applicable in this scenario. The Lambda resource policy is used to control access to the Lambda function, while the AWS KMS key policy is used to manage access to the CMK. The two policies are separate and serve different purposes. Therefore, the correct steps to implement the necessary permissions for decrypting and using AWS Lambda environment variables encrypted with AWS KMS CMKs are to add AWS KMS permissions in the Lambda execution role (option B) and allow the Lambda execution role in the AWS KMS key policy (option D).