Study. uk . com
  1. Home
  2. All questions
  3. Question 103

AWS Certified Solutions Architect study material · question 103 of 500

Which two things must be true for a principal to use a KMS key? Choose two.

  1. The principal created the key
  2. A key policy, IAM policy or grant explicitly allows the action
  3. No applicable policy explicitly denies the action
  4. The principal is the account root user
Show the answer

Answer: B. A key policy, IAM policy or grant explicitly allows the action
C. No applicable policy explicitly denies the action

No principal, not even the root user or the key's creator, has any permission on a KMS key without an explicit allow and no deny.

Source: Key policies in AWS KMS (Amazon Web Services) — Key policies in AWS KMS

Challenge yourself on this topic → Study as cards