SAP-C02 Practice Question 61: Encrypted AMI Cross Account Sharing
AWS Certified Solutions Architect – Professional (SAP-C02) · Test 7 · question 1 of 10
A central image-factory account builds hardened golden AMIs with an automated pipeline. The AMIs' EBS snapshots are encrypted with the default AWS managed key for EBS (aws/ebs), which is required by the company's baseline. Forty workload accounts in the same AWS Organization must launch instances from these AMIs. The security team has rejected making AMIs public, and it requires that the workload accounts get access to the encryption key only through a key policy that the image-factory account controls.
Attempts to share the AMIs with the workload accounts result in instances that cannot be launched there. What should the solutions architect do?
Show answer and explanation
Answer:
To share an AMI that is backed by encrypted snapshots, AWS states: *"When you share an encrypted snapshot, you must also share the customer managed key used to encrypt the snapshot."* The key policy must grant the other accounts permissions such as kms:Decrypt, kms:DescribeKey and kms:CreateGrant, and only a customer managed key's policy can be edited that way. The AWS managed key aws/ebs cannot be shared, because its key policy is not editable by the customer. Copying the AMI with a customer managed key re-encrypts the snapshots so that the image-factory account fully controls who can use the key. A key policy condition on the organization ID grants access to all forty accounts without listing each one (option C).
- A is wrong because the key policy of an AWS managed key cannot be edited by the customer, so the workload accounts can never be added to it. - B is wrong because service control policies only limit the maximum permissions available in an account. They never grant access, and they do not change any key policy. - D is wrong because an AMI whose snapshots are encrypted cannot be shared publicly, and public sharing would also violate the security team's requirement.
Reference: Share the KMS key used to encrypt a shared Amazon EBS snapshot