An application running on EC2 instances must use a username and password to access a database. The developer has stored those secrets in the SSM Parameter Store with type SecureString using the default KMS CMK.
Which combination of configuration steps will allow the application to access the secrets via the API?
Select 2 answers from the options below
 

Answer options:

A.Add the EC2 instance role as a trusted service to the SSM service role.
B.Add permission to use the KMS key to decrypt to the SSM service role.
C.Add permission to read the SSM parameter to the EC2 instance role.
D.Add permission to use the KMS key to decrypt to the EC2 instance role
E.Add the SSM service role as a trusted service to the EC2 instance role. 

Answer – C and D
Option A is incorrect because the entire service does not need to provide a trusted service.
Option B is incorrect because the EC2 instance requires access to encrypt and decrypt and not the SSM service role.
Option C is CORRECT because we need to add permission to read the SSM parameter to the EC2 instance role.
Option D is CORRECT because we need to add permission to use the KMS key to decrypt to the EC2 instance role which allows the application to access the secrets via the API.
Option E is incorrect because the entire service does not need to provide a trusted service.
The below example policy from the AWS Documentation is required to be given to the EC2 Instance in order to read a secure string from AWS KMS. Permissions need to be given to the Get Parameter API and the KMS API call to decrypt the secret.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ssm:GetParameter*"
],
"Resource": "arn:aws:ssm:us-west-2:111122223333:/parameter/ReadableParameters/*"
},
{
"Effect": "Allow",
"Action": [
"kms:Decrypt"
],
"Resource": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}
]
}
For more information on the parameter store, please visit the below URL
https://docs.aws.amazon.com/kms/latest/developerguide/services-parameter-store.html