Exam AWS Certified SysOps Administrator - Associate topic 1 question 260 discussion

Things to note: you have an EC2 instance with encrypted EBS volumes with AWS managed keys (key point right here). Then, you create an AMI from this EC2 instance. This means it will be encrypted with that same AWS managed key. The requirement is simple, use KMS managed keys and only share with authorized accounts. Now the options: A- This starts good as you need a customer managed KMS key to be able to change the policy and add those kms actions to the other AWS accounts, however, that won't help with your AMI since it's still encrypted with the AWS managed key. C - this sounds good right up until the end, public kills it. even though they won't have the actions, you don't want to make it public. D - can't be D, you cannot modify the policy on a AWS managed key.

Can't share "AWS managed key" with other accounts. Even though these keys are created transparently by default in background for many services, since you can't share them or export them, the data is ONLY good within that account. If you want to start sharing things, then you have to use Customer managed KMS keys (so your are responsible for encryption security and not AWS).

option A ,still encrypted with the AWS managed key ,but we need KMS managed keys,so A is out

1. create Key (D out) 2. create copy of AMI (C out) 3. share with accounts - not public (B out)

Option D is incorrect because modifying the key policy of the AWS managed key is not recommended, and it is not possible to share an AMI encrypted with an AWS managed key with other AWS accounts, you need to use customer-managed key. Just to clear out why it is not answer D, because I see there are some claims to support that answer.

The answer is B. defmania00 does justice to the needed explanation.

I was doing this scenario last week. B is the correct answer.

All answers assumed that AMI was created so, the correct answer should be D.

Ans D, aws key