Exam AWS Certified SysOps Administrator - Associate topic 1 question 114 discussion

thanks for the URL - however, this URL indicates the answer is actually D and NOT C.

C is correct

When you copy an AMI, the copied AMI is encrypted using the same AWS KMS key as the original AMI, by default. If the original AMI is encrypted with a default EBS key, the copied AMI will also be encrypted with a default EBS key, and this key will be unique to the account to which the AMI is copied. Therefore, there’s no need to re-encrypt the AMI in the destination account.vThe issue here is that the CloudFormation template is still referencing the old AMI ID from the source account, which is not recognized in the destination account. Hence, updating the CloudFormation template with the new AMI ID (option D) is the correct action to resolve the issue.

While it is necessary to update the CloudFormation template with the new AMI ID after copying it to the destination account, this action alone won't solve the encryption key access issue. The failure is likely due to the lack of access to the KMS key, not merely the AMI ID reference When an AMI is encrypted, it is done so using a specific AWS Key Management Service (KMS) key. If you copy an encrypted AMI to another AWS account, the destination account needs appropriate permissions to use the KMS key that encrypted the AMI, or the AMI needs to be re-encrypted with a KMS key that belongs to the destination account.

where is it said that "Copied AMI already is encrypted by KMS key that is stored in target aws account." ???

I agree