Security World 3 · Lock and Key · Stage 1

Key Policy First

IAM says yes and the key says no. The key policy is the primary authority; grants and conditions are how services and moments are let in.

Domain: Security
World: Security World 3: Lock and Key (Professional)
Game type: Policy stepper: Edit identity, resource and key policies; the matrix shows the gate that decided.
Time: About 20 minutes on a first attempt (estimated)
Exam guides: SAA-C03Task 1.3: Determine appropriate data security controls
DEA-C01Skill 4.3.2: Use encryption keys to encrypt or decrypt data (for example, AWS KMS); Skill 4.3.3: Configure encryption across AWS account boundaries
SAP-C02Task 1.2: Prescribe security controls
SCS-C03Skill 5.2.1: Design, implement, and configure data encryption at rest based on specific requirements (for example, by selecting the appropriate encryption key service such as AWS CloudHSM or AWS KMS or by selecting the appropriate encryption type such as client-side encryption or server-side encryption); Skill 5.3.5: Create and manage encryption keys and certificates across a single AWS Region or multiple Regions (for example, AWS KMS customer managed AWS KMS keys, AWS Private Certificate Authority); Skill 4.2.1: Design and evaluate authorization controls for human, application, and system access (for example, Amazon Verified Permissions, IAM paths, IAM Roles Anywhere, resource policies for cross-account access, IAM role trust policies)