An application is running on Amazon EC2. It has an attached IAM role that is receiving an AccessDenied error while trying to access a SecureString parameter resource in the AWS Systems Manager Parameter Store. The SecureString parameter is encrypted with a customer-managed Customer Master Key (CMK), What steps should the DevOps Engineer take to grant access to the role while granting least privilege? (Choose three.)
A) Set ssm:GetParamter for the parameter resource in the instance role's IAM policy. Set ssm:GetParamter for the parameter resource in the instance role's IAM policy.
B) Set kms:Decrypt for the instance role in the customer-managed CMK policy. kms:Decrypt for the instance role in the customer-managed CMK policy.
C) Set kms:Decrypt for the customer-managed CMK resource in the role's IAM policy. for the customer-managed CMK resource in the role's IAM policy.
D) Set ssm:DecryptParameter for the parameter resource in the instance role IAM policy. ssm:DecryptParameter for the parameter resource in the instance role IAM policy.
E) Set kms:GenerateDataKey for the user on the AWS managed SSM KMS key. kms:GenerateDataKey for the user on the AWS managed SSM KMS key.
F) Set kms:Decrypt for the parameter resource in the customer-managed CMK policy. for the parameter resource in the customer-managed CMK policy.

Question

Quizplus · Accepted Answer

The Answer of An application is running on Amazon EC2. It has an attached IAM role that is receiving an AccessDenied error while trying to access a SecureString parameter resource in the AWS Systems Manager Parameter Store. The SecureString parameter is encrypted with a customer-managed Customer Master Key (CMK), What steps should the DevOps Engineer take to grant access to the role while granting least privilege? (Choose three.)
A) Set ssm:GetParamter for the parameter resource in the instance role's IAM policy. Set ssm:GetParamter for the parameter resource in the instance role's IAM policy.
B) Set kms:Decrypt for the instance role in the customer-managed CMK policy. kms:Decrypt for the instance role in the customer-managed CMK policy.
C) Set kms:Decrypt for the customer-managed CMK resource in the role's IAM policy. for the customer-managed CMK resource in the role's IAM policy.
D) Set ssm:DecryptParameter for the parameter resource in the instance role IAM policy. ssm:DecryptParameter for the parameter resource in the instance role IAM policy.
E) Set kms:GenerateDataKey for the user on the AWS managed SSM KMS key. kms:GenerateDataKey for the user on the AWS managed SSM KMS key.
F) Set kms:Decrypt for the parameter resource in the customer-managed CMK policy. for the parameter resource in the customer-managed CMK policy.

An Application Is Running on Amazon EC2