Exam AWS Certified Security - Specialty topic 1 question 475 discussion

[Explanation] While it's true that the AWS Lambda function's execution role would need permission to use the KMS key to decrypt the AMI (via the kms:Decrypt permission), the kms:CreateGrant permission isn't usually necessary for launching an EC2 instance from an encrypted AMI. The kms:CreateGrant permission is used to delegate access to the KMS key to other principals, which isn't described as necessary in this scenario. The most likely reason for the access denied error, given the provided scenario, is that the execution role for the Lambda function does not have the iam:PassRole permission, which is needed to attach an IAM role to the EC2 instance that it's attempting to launch. [Correct option(s)] B. The Lambda function's execution role does not have iam:PassRole permission for the requested IAM instance profile.

The access denied error message from the Lambda function's execution role is most likely caused by: A. The Lambda function’s execution role does not have kms:CreateGrant and kms:Decrypt KMS key permissions for the encrypted AMI. When launching an EC2 instance from an encrypted AMI using a customer managed key in AWS KMS, the Lambda function's execution role needs the kms:CreateGrant and kms:Decrypt permissions for the KMS key used to encrypt the AMI. These permissions allow the Lambda function to create a grant to decrypt the key and access the encrypted AMI during the provisioning process. Without these KMS permissions, the Lambda function's execution role will be denied access to the encrypted AMI, resulting in an access denied error.

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html iam:PassRole is needed in order to launch EC2 with a specific role attached

https://repost.aws/knowledge-center/kms-iam-ec2-permission

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/troubleshooting-launch.html#troubleshooting-launch-permissions

https://aws.amazon.com/blogs/security/granting-permission-to-launch-ec2-instances-with-iam-roles-passrole-permission/

I found it difficult to find supporting material for both A and B. I found: https://repost.aws/knowledge-center/kms-launch-ec2-instance Which shows that both 'Decrypt' and 'CreateGrant' are required by the autoscaling service to attach encrypted volumes (but not for the AMI itself). I then found: https://medium.com/@ashish.kalani/permission-model-for-launching-ec2-instance-with-iam-profile-fd3f7340699e suggesting that Passrole is required. In the end, I thought about the security implications of allowing a Lamdba function to provision an EC2 instances that had an Administrator level role, and whether that should be controlled. I went with B, but both could be argued.

Can't be A as kms:CreateGrant doesn't make any sense in this scenario.

A makes more sense to me