A company's SysOps administrator has created an Amazon EC2 instance with custom software that will be used as a template for all new EC2 instances across multiple AWS accounts. The Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the EC2 instance are encrypted with AWS managed keys. The SysOps administrator creates an Amazon Machine Image (AMI) of the custom EC2 instance and plans to share the AMI with the company's other AWS accounts. The company requires that all AMIs are encrypted with AWS Key Management Service (AWS KMS) keys and that only authorized AWS accounts can access the shared AMIs. Which solution will securely share the AMI with the other AWS accounts?
Select an option, then click Submit answer.
Reference / correct answer:
In the account where the AMI was created, create a customer managed KMS key. Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI, and specify the KMS key. Modify the permissions on the copied AMI to specify the AWS account numbers that the AMI will be shared with.
Most accepted answer: B. In the account where the AMI was created, create a customer managed KMS key. Modify the key policy to provide kms:DescribeKey, kms:ReEncrypt*, kms:CreateGrant, and kms:Decrypt permissions to the AWS accounts that the AMI will be shared with. Create a copy of the AMI, and specify the KMS key. Modify the permissions on the copied AMI to specify the AWS account numbers that the AMI will be shared with.
Community votes: B=5, D=1
Selected Answer: B Things to note: you have an EC2 instance with encrypted EBS volumes with AWS managed keys (key point right here). Then, you create an AMI from this EC2 instance. This means it will be encrypted with that same AWS managed key. The requirement is simple, use KMS managed keys and only share with authorized accounts. Now the options: A- This starts good as you need a customer managed KMS key to be able to change the policy and add those kms actions to the other AWS accounts, however, that won't help with your AMI since it's still encrypted with the AWS managed key. C - this sounds good right up until the end, public kills it. even though they won't have the actions, you don't want to make it public. D - can't be D, you cannot modify the policy on a AWS managed key. upvoted 16 times
Selected Answer: B Can't share "AWS managed key" with other accounts. Even though these keys are created transparently by default in background for many services, since you can't share them or export them, the data is ONLY good within that account. If you want to start sharing things, then you have to use Customer managed KMS keys (so your are responsible for encryption security and not AWS). upvoted 5 times
Selected Answer: B option A ,still encrypted with the AWS managed key ,but we need KMS managed keys,so A is out upvoted 3 times
Selected Answer: B 1. create Key (D out) 2. create copy of AMI (C out) 3. share with accounts - not public (B out) upvoted 1 times
Selected Answer: B Option D is incorrect because modifying the key policy of the AWS managed key is not recommended, and it is not possible to share an AMI encrypted with an AWS managed key with other AWS accounts, you need to use customer-managed key. Just to clear out why it is not answer D, because I see there are some claims to support that answer. upvoted 1 times
