Q: 5
A security team manages a company’s AWS Key Management Service (AWS KMS) customer managed
keys. Only members of the security team can administer the KMS keys. The company's application
team has a software process that needs temporary access to the keys occasionally. The security team
needs to provide the application team's software process with access to the keys.
Which solution will meet these requirements with the LEAST operational overhead?
Options
Discussion
Option C
In most cases I'd say C, since grants are perfect for temp controlled access and you don't have to keep flipping the key policy. The only catch is if the app team actually needs more than just occasional bursts-then B might be less hassle. Anyone disagree?
C not B. Modifying the key policy (like in B) is messier and riskier each time, grants (C) are made for this temporary access. Seen similar questions on practice sets.
C . Grants are meant for temporary, programmatic access and easy to revoke, so it's less hassle than editing the policy every time like in B. D adds unnecessary steps importing keys. Trap is thinking you need to mess with key policy at all.
B is wrong, it's C. Key grants are made for exactly this type of temp access, so you don't have to mess with key policies every time. Pretty sure that's the AWS-recommended way for least operational overhead.
C , grants are built for temporary access and mean you don't mess with the key policy every time. B looks tempting but too error-prone if you forget to revert. Anyone think B is really less overhead?
Its B for me. You can just update the key policy when you need to give them access, and reverse it after. Granting permissions as in C is nice but feels a bit extra if it's just occasional use. Maybe I'm missing something about grant benefits though? Anyone see a clear downside to toggling the policy?
C imo. Grants are made for this case, way less overhead than key policy edits, plus you don’t risk locking someone out by accident. Only thing to watch is if the app changes roles often, but that’s rare.
Does editing the key policy (like in B) actually scale if the application team needs access repeatedly but not all the time? Seems like grants (C) are less messy, but is there a downside I'm missing for temp access?
Definitely C. Creating a key grant gives temporary access with minimal overhead, and you don't have to modify the key policy like in B every time. That policy-editing approach is extra manual and risky for mistakes. Pretty sure this matches what AWS expects for temp access but happy to hear if anyone's seen otherwise?
Be respectful. No spam.
