Lambda SNS KMS Encryption Permissions

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

ACD Create an SNS resource policy allowing Lambda (A, D) and a KMS key policy allowing SNS to use the CMK (C).

Question

A healthcare company is developing an AWS Lambda function that publishes notifications to an encrypted Amazon Simple Notification Service (Amazon SNS) topic. The notifications contain protected health information (PHI). The SNS topic uses AWS Key Management Service (AWS KMS) customer managed keys for encryption. The company must ensure that the application has the necessary permissions to publish messages securely to the SNS topic. Which combination of steps will meet these requirements? (Choose three.)
  1. Create a resource policy for the SNS topic that allows the Lambda function to publish messages to the topic. Correct Answer
  2. Use server-side encryption with AWS KMS keys (SSE-KMS) for the SNS topic instead of customer managed keys.
  3. Create a resource policy for the encryption key that the SNS topic uses that has the necessary AWS KMS permissions. Correct Answer
  4. Specify the Lambda function's Amazon Resource Name (ARN) in the SNS topic's resource policy. Correct Answer
  5. Associate an Amazon API Gateway HTTP API with the SNS topic to control access to the topic by using API Gateway resource policies.

Key Takeaways

The common trap is assuming that because SNS manages encryption, the publisher does not need KMS permissions; however, with CMKs, explicit permissions in the KMS key policy are required for the SNS service to encrypt on behalf of the publisher.

This question tests the necessary IAM and resource policies for a Lambda function publishing encrypted messages to an Amazon SNS topic using a Customer Managed Key (CMK). The correct configuration requires both an SNS topic policy granting publish access and a KMS key policy allowing SNS to use the encryption key.

Common mistake: Many candidates select D instead of C, believing that specifying the Lambda ARN in the SNS policy is sufficient. This overlooks the fact that without KMS permissions, the SNS topic cannot actually encrypt the payload using the specified CMK.

Expert Analysis

Why the Answer Is Correct

To securely publish PHI to an encrypted SNS topic, two distinct permission layers must be configured. First, the SNS topic itself must allow the Lambda function to send messages; this is achieved by creating a resource policy on the SNS topic (Option A) that explicitly specifies the Lambda function's ARN (Option D). Second, because the topic uses a Customer Managed Key (CMK), the SNS service needs permission to use that key for encryption. AWS documentation states that you must add permissions to the KMS key policy to allow Amazon SNS to encrypt and decrypt messages (Option C). Without these KMS permissions, the publish operation will fail or result in unencrypted data depending on configuration, violating security requirements.

Why the Other Options Are Wrong

Option B suggests switching to SSE-KMS with AWS-managed keys, but the requirement specifies using customer managed keys, making this irrelevant. Option E introduces API Gateway, which is unnecessary complexity and not part of the direct Lambda-to-SNS invocation path described. Option D alone is insufficient because it grants SNS access but fails to grant the underlying KMS service permission to perform the cryptographic operations required by the CMK setup.

Community Comment Notes

Community consensus heavily favors AC, with several users noting that while D is technically part of the SNS policy setup, the critical missing piece often missed is the KMS key policy (C). One user noted 'D is correct too and С is not clear', highlighting confusion about whether SNS handles encryption internally. Another user correctly pointed out that 'If using a custom KMS key, include the following in the key policy to allow Amazon SNS to encrypt'. The debate often centers on whether D is a separate step or part of A; in exam logic, A describes the action of creating the policy, and D describes the content, but C is the distinct third requirement for CMKs.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When dealing with encrypted services using CMKs, always check if the consuming service (like SNS) needs explicit permissions in the KMS key policy to encrypt/decrypt. Do not assume the service handles all crypto automatically when a CMK is involved.

Frequently Asked Questions

Why does Lambda need KMS permissions if SNS encrypts?

Lambda doesn't need KMS permissions directly. However, the SNS service needs KMS permissions in the key policy to encrypt the message on behalf of Lambda when using a CMK.

Is specifying the Lambda ARN in the SNS policy enough?

No. Specifying the ARN (Option D) allows the call, but without the KMS key policy (Option C), the SNS topic cannot encrypt the payload using the Customer Managed Key.

More SAA-C03 FAQ →

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. elmyth 👍 4
    D is correct too and С is not clear, but seems like it is about KMS policy and adding permissions for sns service which has to be added in case of CMK
  2. EllenLiu 👍 2
    I don't understand why lambda needs KMS to encrypt message. In this scenario, the Lambda function does not need direct permissions to use the KMS key because the encryption and decryption are fully managed by Amazon SNS as part of the SSE-KMS feature. SNS is the only service lambda will talk to, The Lambda interacts with SNS using HTTPS and does not directly deal with the encrypted data or the KMS key. so Lambda only needs the permission to publish messages to the SNS topic. I would like to choose F only if #F answer can be updated as below: F. Configure a Lambda execution role that has the necessary IAM permissions to publish to the SNS topic. A: Create a resource policy for the SNS topic => grants lambda the ability to publish messages to the topic C: The KMS key resource policy must allow SNS to use the key for encryption and decryption. F: Configure the Lambda Execution Role => SNS permissions to publish to the topic
  3. LeonSauveterre 👍 2
    A - This is a must-do. B - As question stated, we have no reason to replace the keys. C - This ensures the function can encrypt messages when publishing. D - While specifying the Lambda function's ARN in the SNS topic's resource policy is part of the solution (it's how you grant the "sns:Publish" permission), it's not sufficient on its own. You also need the KMS key policy and the Lambda execution role permissions. This option is a part of option A, not a standalone answer. E - The Lambda function interacts directly with the SNS topic, and API Gateway is not relevant. F - Yes, so that this role will have policies that allow the "kms:Encrypt", "kms:GenerateDataKey," and "kms:Decrypt" actions on the specific KMS key used to encrypt the topic.
  4. JA2018 👍 2
    #A: This is essential because the resource policy on the SNS topic will define which entities (like the Lambda function) are allowed to publish messages to it. #D: By specifying the Lambda function's ARN in the SNS topic policy, you clearly grant access only to that specific Lambda function. #F: Since the SNS topic uses a customer-managed KMS key, the Lambda execution role must have the necessary permissions to use that key for encryption/decryption when publishing messages.
  5. GOTJ 👍 1
    Does a SNS topic need to decrypt an encrypted message in order to deliver it to its subscribers? If so, option "C" should be in. If not, it should be out. And I think is out, unless SNS topic needs to apply certain logic to the message prior to subscription deliver (filters). This question requires a CSE-KMS approach, which force the Lambda function to encrypt the message before publishing, so option "F" is a must (I think everybody here is on the same page with this one). Also, option "A" should be obvious by now. And even though option "D" is redundant, it's technically correct, so it's a better choice.
Show 5 more comments
  1. FlyingHawk 👍 1
    For C - https://docs.aws.amazon.com/sns/latest/dg/sns-enable-encryption-for-topic.html Permissions for custom KMS keys – If using a custom KMS key, include the following in the key policy to allow Amazon SNS to encrypt and decrypt messages:
  2. Abbas_Abi_AWS 👍 8
    A C F is corrcet
  3. komorebi 👍 4
    Answer is ADF
  4. progounick 👍 3
    ChatGPT agrees with me
  5. agbor_tambe 👍 1
    my answer

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide