Exam AWS Certified Security - Specialty topic 1 question 482 discussion

Iam policy is not must if key policy allow access

EC2A doesn't has any IAM KMS*

I agree, for EC2A you need an IAM policy that allows the use of the key. The key policy alone is not enough

But if it is a same account then does it still need IAM policy for EC2A as the key policy already explicit allow t

Also reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html For most resources, you only need an explicit allow for the principal in either an identity-based policy or a resource-based policy to grant access. IAM role trust policies and KMS key policies are exceptions to this logic, because they must explicitly allow access for principals. I'd then review the example provided on: https://docs.aws.amazon.com/kms/latest/developerguide/customer-managed-policies.html#iam-policy-example-deny-disable-delete The following IAM policy prevents a user from disabling or deleting any KMS keys, even when another IAM policy or a key policy allows these permissions. A policy that explicitly denies permissions overrides all other policies, even those that explicitly allow the same permissions. Which suggests that IAM policy will overwrite KMS policy (when there is a deny).