Infrastructure Security

Question 1

You are setting up guarduty to write encrypted data to s3 what three permission types do you need to add ?

Answer 1

1 - S3 policy - to allow Guardduty to use the bucket
2 - Key Policy - to allow Guardduty to use the CMK
3 - Addition to the key policy to allow Guardduty to generate a data key

Question 2

What is a key policy in KMS ?

Answer 2

A reource based policy that controls access to the CMK