A Developer has created a new AWS IAM user that has s3 putObject permission to write to a specific Amazon S3 bucket. This S3 bucket uses server-side encryption with AWS KMS managed (SSE-KMS) as the default encryption. Using the access key and secret key of the IAM user, the application received an access denied error when calling the PutObject API. How can this issue be resolved?
A) Update the policy of the IAM user to allow the s3 Encrypt action.
B) Update the bucket policy of the S3 bucket to allow the IAM user to upload objects.
C) Update the policy of the IAM user to allow the kms:GenerateDataKey action.
D) Update the ACL of the S3 bucket to allow the IAM user to upload objects.

Question

Quizplus · Accepted Answer

The IAM user needs permission to use the KMS key for encryption, specifically the kms:GenerateDataKey action, to successfully upload objects to an S3 bucket with SSE-KMS encryption.

A Developer Has Created a New AWS IAM User That