Lambda S3 KMS Decryption Permissions

DEA-C01 By islever Editorial Last updated

Apply authorization mechanisms.

Short answer

D The Lambda function’s execution role does not have the necessary permissions to access the KMS key that can decrypt the S3 object.

Question

A data engineer set up an AWS Lambda function to read an object that is stored in an Amazon S3 bucket. The object is encrypted by an AWS KMS key. The data engineer configured the Lambda function’s execution role to access the S3 bucket. However, the Lambda function encountered an error and failed to retrieve the content of the object. What is the likely cause of the error?
  1. The data engineer misconfigured the permissions of the S3 bucket. The Lambda function could not access the object.
  2. The Lambda function is using an outdated SDK version, which caused the read failure.
  3. The S3 bucket is located in a different AWS Region than the Region where the data engineer works. Latency issues caused the Lambda function to encounter an error.
  4. The Lambda function’s execution role does not have the necessary permissions to access the KMS key that can decrypt the S3 object. Correct Answer

Key Takeaways

The exam tests the separation of duties between S3 data access and KMS cryptographic operations, where a common trap is assuming bucket policy grants full object read capability including decryption.

This question tests the authorization requirements for AWS Lambda functions accessing encrypted Amazon S3 objects. It establishes that separate IAM permissions are needed for S3 access and KMS decryption.

Common mistake: Learners often select Option A because they overlook the encryption detail, assuming the issue lies solely with the S3 bucket policy rather than the specific KMS key usage.

Expert Analysis

Why the Answer Is Correct

The correct answer is D because accessing an S3 object encrypted with a Customer Master Key (CMK) requires two distinct sets of permissions: 's3:GetObject' to retrieve the encrypted data from the bucket, and 'kms:Decrypt' to decrypt it. The scenario states the execution role has access to the S3 bucket, implying the 's3:GetObject' permission is likely present. However, without explicit 'kms:Decrypt' permissions on the KMS key in the Lambda's execution role, the function cannot process the encrypted content, resulting in an AccessDenied error.

Why the Other Options Are Wrong

Option A is incorrect because the prompt explicitly states the engineer configured the role to access the bucket; while possible, it ignores the critical encryption context. Option B is unlikely as SDK version issues typically manifest differently and are not the primary security consideration in this scenario. Option C is invalid because S3 is globally accessible via DNS, and cross-region latency does not cause authentication or authorization failures.

Community Comment Notes

The community consensus strongly supports Option D. As AgboolaKun noted, "The object is encrypted with a KMS key: This is a crucial detail," highlighting that encryption adds a layer of access control separate from S3 policies. Other users like matt200 and aragon_saa confirmed the answer is D, reinforcing that KMS permissions are the missing link.

Exam Strategy

Always check if the resource involves encryption (S3 SSE-KMS, RDS, etc.). If it does, verify that the executing entity has both the data-plane permission (e.g., s3:GetObject) AND the control-plane permission (e.g., kms:Decrypt).

Frequently Asked Questions

Does the S3 bucket policy need to allow KMS actions?

No, the S3 bucket policy only needs to allow s3:GetObject. The KMS policy must allow the Lambda role to perform kms:Decrypt.

What happens if I grant kms:Decrypt but not s3:GetObject?

The request will fail at the S3 layer with AccessDenied before it even attempts to contact KMS for decryption.

More DEA-C01 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. AgboolaKun 👍 2 Answered D
    The correct answer is D. Here is why: The Lambda function is configured to access the S3 bucket: The data engineer has already set up the Lambda function's execution role to access the S3 bucket. This means that basic S3 access permissions are likely in place. The object is encrypted with a KMS key: This is a crucial detail. When an object in S3 is encrypted with a KMS key, any entity trying to read that object needs two sets of permissions: a. Permission to access the S3 bucket and object b. Permission to use the specific KMS key for decryption The error occurs when trying to retrieve the content: This suggests that the Lambda function can likely see the object (as it has S3 access) but fails when trying to read its contents. To resolve this issue, the data engineer should grant the Lambda function's execution role the required KMS permissions. Specifically, add the 'kms:Decrypt' permission for the KMS key used to encrypt the S3 object.
  2. matt200 👍 1 Answered D
    Option D: The Lambda function’s execution role does not have the necessary permissions to access the KMS key that can decrypt the S3 object.
  3. aragon_saa 👍 1 Answered D
    Answer is D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Amazon Redshift Compound Sort Key Query Optimization

S-grade

Secure Redshift Spectrum Access with VPC Endpoints

S-grade

Athena Federated Query for Multi-Source Iceberg Pipelines

S-grade

Reclaiming Storage in Amazon Redshift Materialized Views

S-grade

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide