Lambda S3 KMS Decryption Permissions

Apply authorization mechanisms.
Answer Correct answer: D — The Lambda function’s execution role does not have the necessary permissions to access the KMS key that can decrypt the S3 object.

A data engineer set up an AWS Lambda function to read an object that is stored in an Amazon S3 bucket. The object is encrypted by an AWS KMS key. The data engineer configured the Lambda function’s execution role to access the S3 bucket. However, the Lambda function encountered an error and failed to retrieve the content of the object. What is the likely cause of the error?

  1. The data engineer misconfigured the permissions of the S3 bucket. The Lambda function could not access the object.
  2. The Lambda function is using an outdated SDK version, which caused the read failure.
  3. The S3 bucket is located in a different AWS Region than the Region where the data engineer works. Latency issues caused the Lambda function to encounter an error.
  4. The Lambda function’s execution role does not have the necessary permissions to access the KMS key that can decrypt the S3 object. Correct Answer

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests the separation of duties between S3 data access and KMS cryptographic operations, where a common trap is assuming bucket policy grants full object read capability including decryption.

This question tests the authorization requirements for AWS Lambda functions accessing encrypted Amazon S3 objects. It establishes that separate IAM permissions are needed for S3 access and KMS decryption.

Learners often select Option A because they overlook the encryption detail, assuming the issue lies solely with the S3 bucket policy rather than the specific KMS key usage.

Community Discussion (3 comments)

AgboolaKun 👍 2 Selected: D
The correct answer is D. Here is why: The Lambda function is configured to access the S3 bucket: The data engineer has already set up the Lambda function's execution role to access the S3 bucket. This means that basic S3 access permissions are likely in place. The object is encrypted with a KMS key: This is a crucial detail. When an object in S3 is encrypted with a KMS key, any entity trying to read that object needs two sets of permissions: a. Permission to access the S3 bucket and object b. Permission to use the specific KMS key for decryption The error occurs when trying to retrieve the content: This suggests that the Lambda function can likely see the object (as it has S3 access) but fails when trying to read its contents. To resolve this issue, the data engineer should grant the Lambda function's execution role the required KMS permissions. Specifically, add the 'kms:Decrypt' permission for the KMS key used to encrypt the S3 object.
aragon_saa 👍 1 Selected: D
Answer is D
matt200 👍 1 Selected: D
Option D: The Lambda function’s execution role does not have the necessary permissions to access the KMS key that can decrypt the S3 object.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The correct answer is D because accessing an S3 object encrypted with a Customer Master Key (CMK) requires two distinct sets of permissions: 's3:GetObject' to retrieve the encrypted data from the bucket, and 'kms:Decrypt' to decrypt it. The scenario states the execution role has access to the S3 bucket, implying the 's3:GetObject' permission is likely present. However, without explicit 'kms:Decrypt' permissions on the KMS key in the Lambda's execution role, the function cannot process the encrypted content, resulting in an AccessDenied error.

Why the Other Options Are Wrong

Option A is incorrect because the prompt explicitly states the engineer configured the role to access the bucket; while possible, it ignores the critical encryption context. Option B is unlikely as SDK version issues typically manifest differently and are not the primary security consideration in this scenario. Option C is invalid because S3 is globally accessible via DNS, and cross-region latency does not cause authentication or authorization failures.

Community Comment Notes

The community consensus strongly supports Option D. As AgboolaKun noted, "The object is encrypted with a KMS key: This is a crucial detail," highlighting that encryption adds a layer of access control separate from S3 policies. Other users like matt200 and aragon_saa confirmed the answer is D, reinforcing that KMS permissions are the missing link.

Exam Strategy

Always check if the resource involves encryption (S3 SSE-KMS, RDS, etc.). If it does, verify that the executing entity has both the data-plane permission (e.g., s3:GetObject) AND the control-plane permission (e.g., kms:Decrypt).

Frequently Asked Questions

Does the S3 bucket policy need to allow KMS actions?

No, the S3 bucket policy only needs to allow s3:GetObject. The KMS policy must allow the Lambda role to perform kms:Decrypt.

What happens if I grant kms:Decrypt but not s3:GetObject?

The request will fail at the S3 layer with AccessDenied before it even attempts to contact KMS for decryption.

More DEA-C01 FAQ →

Related Analysis

An ecommerce company operates a complex order fulfilment pro

S-Grade

A company is using Amazon Redshift to build a data warehouse

A-Grade

A company uses Amazon S3 to store semi-structured data in a

S-Grade

Practice All DEA-C01 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DEA-C01 Practice Test →

← Back to DEA-C01 Study Guide