2.2 - Encryption and authorization (KMS, envelope, explicit Deny)
AWS Certified Developer Associate objective 2.2 covers encryption and authorization for developers. Envelope encryption encrypts a large payload with a data key, and that data key is itself encrypted by a KMS key - efficient because you only call KMS for the small key, not the whole payload. When a developer must digitally sign messages and let others verify them with a public key, an asymmetric KMS key configured for sign and verify is the tool. You must also know policy evaluation: when two IAM policies apply and one allows s3:GetObject while another has an explicit Deny, access is denied because an explicit Deny always overrides any Allow. You should also know KMS key policies, grants and data key caching. Expect scenario questions that describe efficient large-payload encryption, signing and verification, or a conflicting Allow and Deny, and ask which mechanism or outcome is correct.
Encrypt a big payload with a data key that KMS encrypts = envelope encryption. Sign + verify with a public key = asymmetric KMS key. Allow + explicit Deny = Deny always wins.
Practice questions
1. Which technique encrypts a large payload with a data key that is itself encrypted by a KMS key?
- Envelope encryption (correct answer)
- Client certificate pinning
- Signed URL generation
- Password hashing
In envelope encryption, KMS generates a data key: you encrypt data with the plaintext data key, then store the KMS-encrypted data key alongside. Only KMS can decrypt the data key.
2. Which statement about IAM policy evaluation is correct?
- An explicit Deny always overrides any Allow (correct answer)
- An explicit Allow overrides an explicit Deny
- Access is allowed by default without any policy
- Resource policies are ignored if a role exists
IAM evaluation is deny-by-default; an Allow grants access, but any explicit Deny always wins. This ordering underpins guardrails like SCPs and bucket policies.
3. An application in account A must read an S3 bucket in account B. Which pattern grants access most securely without long-term keys?
- Copy account B access keys into account A
- Make the bucket public with a broad policy
- Assume an IAM role in account B via STS AssumeRole (correct answer)
- Email a pre-signed URL for every object read
Cross-account access is done by defining a role in account B that trusts account A, then calling STS AssumeRole to get temporary credentials. This avoids sharing long-term keys and making the bucket public.
4. A KMS-encrypted secret must be decrypted by a Lambda whose execution role has kms:Decrypt, but the call is denied. What most likely also needs to allow the role?
- The Lambda reserved concurrency setting
- A larger function timeout for the KMS call
- A VPC internet gateway for the subnet
- The KMS key policy granting the role access (correct answer)
KMS access requires both an IAM permission and the key policy to allow the principal. A key policy is authoritative for the KMS key, so even with kms:Decrypt in IAM, the key policy (or a grant) must also permit the role.
5. Which KMS operation returns both a plaintext data key and its encrypted copy, for envelope encryption of large data?
- Encrypt with the KMS key directly
- CreateGrant on the KMS key
- GenerateDataKey on the KMS key (correct answer)
- DescribeKey for the KMS key metadata
GenerateDataKey returns a plaintext data key (to encrypt data locally) and the same key encrypted under the KMS key (to store). This is the core of envelope encryption; the direct Encrypt API is limited to 4 KB.
6. A team wants to cap the maximum permissions a developer's IAM role can ever have, even if broad policies are attached. Which feature enforces this ceiling?
- A resource-based policy on each service
- An inline policy duplicated on the role
- A larger set of managed policies attached
- A permissions boundary on the IAM role (correct answer)
A permissions boundary is a managed policy that sets the maximum permissions an identity can have; effective permissions are the intersection of the boundary and its policies. It cannot grant, only cap.