Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 219 discussion

Log Files (SSE-KMS): Logs are encrypted using a KMS key. To decrypt them, the security engineer’s IAM role/user must have kms:Decrypt permissions in the KMS key policy. If the key policy lacks these permissions, the engineer cannot decrypt the logs, even if they have S3 GetObject access. Digest Files (SSE-S3 by Default): Digest files inherit the S3 bucket’s default encryption, which is often SSE-S3 (AWS-managed keys) unless explicitly configured otherwise. SSE-S3 does not require KMS permissions, allowing the engineer to read digest files with standard S3 GetObject access.

KMS Key Policy Permissions: If the KMS key policy does not explicitly grant the necessary decrypt permissions to the security engineer's IAM user or role, they will not be able to read the encrypted log files. This is a common issue when dealing with SSE-KMS encryption. Digest Files: These files are not encrypted with the KMS key, which is why they are readable even if the log files are not. To resolve this, the security engineer should ensure that the KMS key policy includes the appropriate permissions for their IAM user or role to decrypt the log files.