Question 19:
As a Cloud Security Engineer, you perform a security audit of AWS services that your company is using. You have found that for customer master keys(CMKs) in KMS, the key policies are too open, allowing almost all services or users to use them. Take below key policy as an example:
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:user/John"
},
"Action": "kms:CreateGrant",
"Resource": "*"
}
The user John can create grants on the key without any restriction. You want to create a condition in the key policy to ensure that the grant should only be created by integrated AWS services rather than the user himself. How should you achieve that?
Answer options:
A.Add the below condition in the key policy:
"Condition": {
"Bool": {
"kms:ViaService": true
}
}
B.Add the below condition in the key policy:
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": true
}
}
C.Add the below condition in the key policy:
"Condition": {
"Bool": {
"kms:KeyOrigin": true
}
}
D.Add the below condition in the key policy:
"Condition": {
"Bool": {
"kms:GranteePrincipal": true
}
}