DEA-C01 Practice Question 73: Kinesis Cross Account CMK Access
AWS Certified Data Engineer – Associate (DEA-C01) · Test 8 · question 3 of 10
A Kinesis data stream in account A uses server-side encryption with the AWS managed key for Kinesis. The team shares the stream with a consumer role in account B by using a resource policy, but the consumer's reads fail with an access denied error on the encryption key. What should the team do?
Show answer and explanation
Answer:
AWS documents that *"when encrypting your data streams and sharing access to other principals, you must grant permission in both the key policy for the AWS KMS key and the IAM policies in the external account."* It also states that if server-side encryption uses the AWS managed key and you want to share access through a resource policy, *"you must switch to using customer-managed key (CMK)."* Only a customer managed key lets the team edit the key policy for another account (option D).
- A is wrong because the failure is on the encryption key, not on Kinesis permissions. More Kinesis actions do not grant use of the KMS key. - B is wrong because it removes encryption at rest, which weakens the security posture. Existing requirements to encrypt would no longer be met. - C is wrong because the key policy of an AWS managed key cannot be edited by the customer. That is why the switch to a customer managed key is needed.
Reference: What is server-side encryption for Kinesis Data Streams?