Study. uk . com
  1. Home
  2. All questions
  3. Question 55

AWS Certified Solutions Architect study material · question 55 of 500

An IAM policy grants kms:Decrypt on a key, but the key policy does not enable IAM policies. What happens when the principal calls Decrypt?

  1. The call succeeds after the key is rotated
  2. The call is denied, because the key policy must first allow IAM policies to take effect
  3. The call succeeds, because IAM policies always override key policies
  4. The call succeeds only for the account root user
Show the answer

Answer: B. The call is denied, because the key policy must first allow IAM policies to take effect

An IAM allow on a KMS key does nothing unless the key policy enables IAM policies; an IAM policy can still deny on its own.

Source: Key policies in AWS KMS (Amazon Web Services) — Key policies in AWS KMS

Challenge yourself on this topic → Study as cards