Q29 — AWS SAA-C03 Ch.6

Question 29 of 65 | ← Chapter 6

Q394. A company has an application workflow that uses an AWS Lambda function to download and decrypt files from Amazon S3. These files are encrypted using AWS Key Management Service Customer Master Keys (AWS KMS CMKs).A solutions architect needs to design a solution that will ensure the required permissions are set correctly. Which combination of actions accomplish this? (Select TWO.)

• A. Attach the kms.decrypt permission to the Lambda function's resource policy.
• B. Grant the decrypt permission for the Lambda IAM role in the KMS key's policy. ✓
• C. Grant the decrypt permission for the Lambda resource policy in the KMS key's policy.
• D. Create a new IAM policy with the kms:decrypt permission and attach the policy to the Lambda function.
• E. Create a new IAM role with the kms decrypt permission and attach the execution role to the Lambda function. ✓

Correct Answer: B. Grant the decrypt permission for the Lambda IAM role in the KMS key's policy., E. Create a new IAM role with the kms decrypt permission and attach the execution role to the Lambda function.

Explanation

By granting the decrypt permission for the Lambda IAM role in the KMS key's policy (Option B), you are allowing the Lambda function's execution role to decrypt the files. Additionally, by creating a new IAM role with the kms:decrypt permission and attaching the execution role to the Lambda function (Option E), you are explicitly granting the Lambda function the necessary permission to perform the decryption operation.Options A, C, and D are incorrect because you do not attach resource policies or create new IAM policies. The required permissions should be granted through roles and policies linked to the IAM role assigned to the Lambda function.