Discuss Amazon DOP-C02 Exam Topic 4 Question 55

A company must encrypt all AMIs that the company shares across accounts. A DevOps engineer has access to a source account where an unencrypted custom AMI has been built. The DevOps engineer also has access to a target account where an Amazon EC2 Auto Scaling group will launch EC2 instances from the AMI. The DevOps engineer must share the AMI with the target account.

The company has created an AWS Key Management Service (AWS KMS) key in the source account.

Which additional steps should the DevOps engineer perform to meet the requirements? (Choose three.)

AIn the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action.

BIn the source account, copy the unencrypted AMI to an encrypted AMI. Specify the default Amazon Elastic Block Store (Amazon EBS) encryption key in the copy action.

CIn the source account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role in the target account.

DIn the source account, modify the key policy to give the target account permissions to create a grant. In the target account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role.

EIn the source account, share the unencrypted AMI with the target account.

FIn the source account, share the encrypted AMI with the target account.

Suggested Answer: A, D, F

The Auto Scaling group service-linked role must have a specific grant in the source account in order to decrypt the encrypted AMI. This is because the service-linked role does not have permissions to assume the default IAM role in the source account.

The following steps are required to meet the requirements:

In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action.

In the source account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role in the target account.

In the source account, share the encrypted AMI with the target account.

In the target account, attach the KMS grant to the Auto Scaling group service-linked role.

The first three steps are the same as the steps that I described earlier. The fourth step is required to grant the Auto Scaling group service-linked role permissions to decrypt the AMI in the target account.

Get Premium DOP-C02 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

27 comments · newest first

Deonna 8 months ago

I feel like D is also important. We need to modify the key policy for proper permissions.

Talia 8 months ago

C makes sense too. We need to ensure the Auto Scaling group can access the KMS key.

Leana 8 months ago

Agreed! A is definitely the first step. But what about option C?

Dominque 8 months ago

I think option A is crucial. We need to encrypt the AMI first.

Josphine 9 months ago

B is not the right choice; you need to specify the KMS key, not the default EBS key.

Lisbeth 9 months ago

I agree, sharing the encrypted AMI is the way to go!

Emeline 9 months ago

Option D is a bit overkill, don't you think? Why go through all that trouble with the key policy and grants?

Lorrie 9 months ago

Haha, I bet the DevOps engineer is sweating bullets trying to figure this out. Gotta love those encryption requirements!

Whitney 9 months ago

I agree with Teresita. Option A is the way to do it.

Teresita 9 months ago

Option A is the correct answer. Encrypting the AMI and specifying the KMS key is the way to go.

Jacklyn 10 months ago

I’m a bit confused about the key policy changes. Do we need to modify it for the target account before or after we create the grant?

Avery 10 months ago

I practiced a similar question where we had to share AMIs, and I feel like sharing the encrypted AMI is the right move here.

Nada 10 months ago

I think we definitely need to create a KMS grant for the target account, but I can't recall if it should be done in the source or target account first.

Glory 10 months ago

Wait, can you really share an unencrypted AMI? Seems risky!

Gennie 10 months ago

Gotta copy the AMI and encrypt it with the KMS key!

Skye 11 months ago

Definitely need to modify the key policy for the target account.

Linette 11 months ago

I remember something about needing to copy the AMI to encrypt it, but I'm not sure if I should use the KMS key or the default EBS key.

Beckie 11 months ago

Hmm, I'm not sure about B and E. Those don't seem to meet the requirement of encrypting the AMI before sharing it.

Tawanna 11 months ago

Based on the question, I believe the right steps are A, C, and F. Copying the AMI to an encrypted version, creating a KMS grant in the source account, and then sharing the encrypted AMI.

Carri 12 months ago

I'm a bit confused about the KMS key and grant permissions. Do I need to do something with those in both the source and target accounts?

Earleen 12 months ago

Okay, I think I've got this. The key is to encrypt the AMI and share the encrypted version with the target account.

Belen 12 months ago

Hmm, this looks like a tricky one. I'll need to carefully read through the requirements and think through the steps.

Lucia 7 months ago

↳ replying to Belen

Don't forget about sharing the encrypted AMI afterward!

Shanda 7 months ago

↳ replying to Belen

Yeah, and we need to ensure the KMS key permissions are set up correctly.

Rosalind 7 months ago

↳ replying to Belen

I think starting with copying the unencrypted AMI to an encrypted one is key.

Nikita 7 months ago

↳ replying to Belen

This is definitely a complex scenario.

Charisse 11 months ago

↳ replying to Belen

Right! We have to make sure the Auto Scaling group can access it too.

Amazon DOP-C02 Exam - Topic 4 Question 55 Discussion