1. Home
2. All questions
3. Question 60

AWS Certified Solutions Architect study material · question 60 of 500

Why do AWS services that encrypt data at rest typically use a KMS grant rather than editing the key policy?

• Secure architecture

1. A grant can be created, used and retired without changing any policy
2. A grant can deny access that a key policy allows
3. A grant applies to every key in the account at once
4. A grant survives deletion of the KMS key

Challenge yourself on this topic → Study as cards