Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Amazon-DEA-C01 Exam - Topic 1 Question 13 Discussion

A company uses Amazon S3 to store data and Amazon QuickSight to create visualizations.The company has an S3 bucket in an AWS account named Hub-Account. The S3 bucket is encrypted by an AWS Key Management Service (AWS KMS) key. The company's QuickSight instance is in a separate account named BI-AccountThe company updates the S3 bucket policy to grant access to the QuickSight service role. The company wants to enable cross-account access to allow QuickSight to interact with the S3 bucket.Which combination of steps will meet this requirement? (Select TWO.)
D) Add an IAM policy to the QuickSight service role to give QuickSight access to the KMS key that encrypts the S3 bucket. and E) Add the KMS key as a resource that the QuickSight service role can access.
A) Use the existing AWS KMS key to encrypt connections from QuickSight to the S3 bucket.
B) Add the 53 bucket as a resource that the QuickSight service role can access.
C) Use AWS Resource Access Manager (AWS RAM) to share the S3 bucket with the Bl-Account account.

Amazon-DEA-C01 Exam - Topic 1 Question 13 Discussion

Actual exam question for Amazon's Amazon-DEA-C01 exam
Question #: 13
Topic #: 1
[All Amazon-DEA-C01 Questions]

A company uses Amazon S3 to store data and Amazon QuickSight to create visualizations.

The company has an S3 bucket in an AWS account named Hub-Account. The S3 bucket is encrypted by an AWS Key Management Service (AWS KMS) key. The company's QuickSight instance is in a separate account named BI-Account

The company updates the S3 bucket policy to grant access to the QuickSight service role. The company wants to enable cross-account access to allow QuickSight to interact with the S3 bucket.

Which combination of steps will meet this requirement? (Select TWO.)

Show Suggested Answer Hide Answer
Suggested Answer: D, E

Problem Analysis:

The company needs cross-account access to allow QuickSight in BI-Account to interact with an S3 bucket in Hub-Account.

The bucket is encrypted with an AWS KMS key.

Appropriate permissions must be set for both S3 access and KMS decryption.

Key Considerations:

QuickSight requires IAM permissions to access S3 data and decrypt files using the KMS key.

Both S3 and KMS permissions need to be properly configured across accounts.

Solution Analysis:

Option A: Use Existing KMS Key for Encryption

While the existing KMS key is used for encryption, it must also grant decryption permissions to QuickSight.

Option B: Add S3 Bucket to QuickSight Role

Granting S3 bucket access to the QuickSight service role is necessary for cross-account access.

Option C: AWS RAM for Bucket Sharing

AWS RAM is not required; bucket policies and IAM roles suffice for granting cross-account access.

Option D: IAM Policy for KMS Access

QuickSight's service role in BI-Account needs explicit permissions to use the KMS key for decryption.

Option E: Add KMS Key as Resource for Role

The KMS key must explicitly list the QuickSight role as an entity that can access it.

Implementation Steps:

S3 Bucket Policy in Hub-Account: Add a policy to the S3 bucket granting the QuickSight service role access:

json

{

'Version': '2012-10-17',

'Statement': [

{

'Effect': 'Allow',

'Principal': { 'AWS': 'arn:aws:iam::<BI-Account-ID>:role/service-role/QuickSightRole' },

'Action': 's3:GetObject',

'Resource': 'arn:aws:s3:::<Bucket-Name>/*'

}

]

}

KMS Key Policy in Hub-Account: Add permissions for the QuickSight role:

{

'Version': '2012-10-17',

'Statement': [

{

'Effect': 'Allow',

'Principal': { 'AWS': 'arn:aws:iam::<BI-Account-ID>:role/service-role/QuickSightRole' },

'Action': [

'kms:Decrypt',

'kms:DescribeKey'

],

'Resource': '*'

}

]

}

IAM Policy for QuickSight Role in BI-Account: Attach the following policy to the QuickSight service role:

{

'Version': '2012-10-17',

'Statement': [

{

'Effect': 'Allow',

'Action': [

's3:GetObject',

'kms:Decrypt'

],

'Resource': [

'arn:aws:s3:::<Bucket-Name>/*',

'arn:aws:kms:<region>:<Hub-Account-ID>:key/<KMS-Key-ID>'

]

}

]

}


Setting Up Cross-Account S3 Access

AWS KMS Key Policy Examples

Amazon QuickSight Cross-Account Access

by Eleonora at Mar 22, 2025, 11:03 AM

Limited Time Offer

25%

Off

Get Premium Amazon-DEA-C01 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Emogene
4 months ago
Just adding the bucket policy should be enough, right?
upvoted 0 times
...
Vivan
5 months ago
I think C is a bit overkill for this scenario.
upvoted 0 times
...
Elvera
5 months ago
Wait, can QuickSight even access KMS keys directly?
upvoted 0 times
...
Tamesha
5 months ago
I vaguely recall that we need to ensure QuickSight can access both the S3 bucket and the KMS key. Adding the KMS key as a resource might be necessary, but I’m not 100% sure.
upvoted 0 times
...
Mila
5 months ago
I'm not entirely sure, but I feel like we might need to give QuickSight access to the KMS key too. That seems important for encryption.
upvoted 0 times
...
Dottie
5 months ago
I remember that cross-account access is tricky, but I think adding the S3 bucket as a resource for the QuickSight role is definitely one of the steps.
upvoted 0 times
...
Gracie
6 months ago
Definitely B and D! Makes total sense.
upvoted 0 times
...
Han
6 months ago
QuickSight needs access to the S3 bucket for sure.
upvoted 0 times
...
Mona
6 months ago
This question reminds me of a practice scenario we did about IAM policies. I think using AWS RAM to share the bucket could be a valid option, but I'm not completely confident.
upvoted 0 times
...
Dortha
6 months ago
I'm not sure about the KMS key part. Do we really need to give QuickSight access to the KMS key, or can we just use the existing key to encrypt the connections?
upvoted 0 times
...
Chaya
6 months ago
I'm pretty confident I know the answer here. We need to do two things: add the S3 bucket as a resource the QuickSight service role can access, and add the KMS key as a resource the QuickSight service role can use to decrypt the bucket.
upvoted 0 times
...
Latosha
7 months ago
Okay, let me think this through. We need to allow QuickSight in the BI-Account to access the S3 bucket in the Hub-Account. So we'll need to update the bucket policy and the QuickSight service role permissions.
upvoted 0 times
...
Haydee
7 months ago
I'm a bit confused about the cross-account access requirement. Do we need to use AWS RAM to share the S3 bucket, or can we just update the bucket policy?
upvoted 0 times
...
Glendora
7 months ago
This seems straightforward. I think the key steps are to grant the QuickSight service role access to the S3 bucket and the KMS key that encrypts it.
upvoted 0 times
...
Dino
7 months ago
The AWS RAM option (C) is interesting, but I'm not sure if that's necessary here since the accounts are already separate. I'd focus on the S3 bucket policy and IAM permissions first.
upvoted 0 times
...
Audry
7 months ago
This seems straightforward enough. I'd go with options B and D to meet the requirement.
upvoted 0 times
...
Sabra
8 months ago
Okay, I think I've got this. We need to add the S3 bucket as a resource the QuickSight service role can access, and also give the QuickSight role access to the KMS key that encrypts the bucket.
upvoted 0 times
...
Kristian
8 months ago
Hmm, I'm a bit confused about the KMS key encryption part. Do we need to do anything specific with the KMS key to enable QuickSight access?
upvoted 0 times
...
Marsha
8 months ago
This looks like a straightforward cross-account access question. I'd start by reviewing the S3 bucket policy and the QuickSight service role to see what permissions are already in place.
upvoted 0 times
...
Lauran
1 year ago
Yes, and we should also add an IAM policy to the QuickSight service role to give QuickSight access to the KMS key that encrypts the S3 bucket.
upvoted 0 times
...
Dell
1 year ago
I believe we should add the KMS key as a resource that the QuickSight service role can access as well.
upvoted 0 times
...
Jaclyn
1 year ago
I agree with that. We also need to add the S3 bucket as a resource that the QuickSight service role can access.
upvoted 0 times
...
Fidelia
1 year ago
Hah, I can just imagine the conversation in the office. 'Wait, you mean we have to use AWS RAM for this? I thought we were just going to add another IAM policy!'
upvoted 0 times
Amalia
1 year ago
Employee 2: Let's also add the S3 bucket as a resource for the QuickSight service role.
upvoted 0 times
...
Nadine
1 year ago
Employee 1: Should we use the existing AWS KMS key for encryption?
upvoted 0 times
...
Ashton
1 year ago
Employee 2: Yeah, we have to update the S3 bucket policy and enable cross-account access.
upvoted 0 times
...
Elvis
1 year ago
Employee 1: So, we need to grant access to QuickSight to interact with the S3 bucket.
upvoted 0 times
...
...
Lauran
1 year ago
I think we should use the existing AWS KMS key to encrypt connections from QuickSight to the S3 bucket.
upvoted 0 times
...
Ma
1 year ago
C is definitely the way to do it. Sharing the S3 bucket through RAM is the simplest and most secure option.
upvoted 0 times
...
Bong
1 year ago
I agree with Mable. B and C are the way to do it. Although D sounds like it could work, it's not the most efficient approach.
upvoted 0 times
Tarra
1 year ago
Yeah, D might work but it seems like B and C are more efficient.
upvoted 0 times
...
Aja
1 year ago
I agree, those seem like the best choices.
upvoted 0 times
...
Sharen
1 year ago
I think we should go with options B and C.
upvoted 0 times
...
...
Mable
1 year ago
B and C are the correct options. Sharing the S3 bucket through AWS RAM is the way to go for cross-account access.
upvoted 0 times
Mi
1 year ago
That makes sense. Sharing through AWS RAM is the best option for cross-account access.
upvoted 0 times
...
Jina
1 year ago
C) Use AWS Resource Access Manager (AWS RAM) to share the S3 bucket with the BI-Account account.
upvoted 0 times
...
Catarina
1 year ago
B) Add the S3 bucket as a resource that the QuickSight service role can access.
upvoted 0 times
...
...

Save Cancel