Question
What is the effect of the following AWS Key Management Service (AWS KMS) key policy that is attached to a customer managed key?
```json
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/ExampleRole"
},
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:GenerateDataKey*",
"kms:CreateGrant",
"kms:ListGrants"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"kms:ViaService": [
"workmail.us-west-2.amazonaws.com",
"ses.us-west-2.amazonaws.com"
]
}
}
}
```
- A. Amazon WorkMail and Amazon Simple Email Service (Amazon SES) have delegated KMS encrypt and decrypt permissions to the ExampleRole principal in the 111122223333 account.
- B. The ExampleRole principal can transparently encrypt and decrypt email exchanges specifically between ExampleRole and AWS.
- C. The customer managed key can be used for encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region. Correct
- D. The key policy allows Amazon WorkMail or Amazon Simple Email Service (Amazon SES) to encrypt or decrypt on behalf of the ExampleRole for any customer managed key in the account.
Explanation
The correct answer is C because the key policy specifies that only the ExampleRole principal from the specified AWS account can perform KMS actions such as Encrypt and Decrypt, but these actions are restricted to requests originating from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in a specific AWS Region.
