Constrain payroll decryption to its context
A hands-on SOA-C03 lab. You produce the real artefact and 9 automated checks verify it behaves the way the exam expects.
Try this labAll SOA-C03 practice
- Certification
- SOA-C03
- Format
- Structured configuration
- Difficulty
- hard
- Estimated time
- 15 min
- Automated checks
- 9
The brief
Repair key-policy.json. Keep IAM policy version 2012-10-17, one Allow statement, and Resource "*" because this policy is already attached to the supplied KMS key. Trust only arn:aws:iam::111122223333:role/payroll-reconciler and allow only kms:Decrypt. Under Condition.StringEquals require kms:EncryptionContext:AppName = payroll-reconciler and kms:EncryptionContext:Environment = production. Also use ForAllValues:StringEquals with kms:EncryptionContextKeys containing exactly AppName and Environment. Do not add another statement or use a wildcard principal or action.
Part of SOA-C03 preparation
Labs are written by ExamNova to teach the decisions the exam tests. They are not reproductions of vendor lab content.