Incident: Finance Reports Fail With KMS AccessDenied
A reporting function can read the bucket but fails the moment S3 needs to decrypt with the customer managed key. The IAM policy looks right at first glance. Find the one condition that never matches, fix it, and prove the report is readable.
Level: Advanced · Time: about 60 minutes · Region: us-east-1
AWS services you'll use
- KMS
- S3
- Lambda
- IAM
What you'll do in this lab
- Let the report reader decrypt through S3, and only through S3
Each task is checked against your live AWS account. Step-by-step instructions, hints and verification unlock when you start the lab.
Before you start
- IAM policy conditions
- SSE-KMS
How the lab works
- Get a real, temporary AWS account locked to one region. No AWS account of your own needed.
- Build in the real AWS console with a guide beside it, and hints when you are stuck.
- Verify every task: we check the resources in your live account.
- Automatic cleanup: everything is deleted when you stop, and nothing is billed to you.
Questions about this lab
Do I need my own AWS account?
No. When you start the lab, Cloud Arena gives you a real, temporary AWS account with its own login, locked to one region. You work in the real AWS Management Console, not a simulator.
Will AWS charge me anything?
No. Cloud Arena pays for the AWS resources, and everything you create is deleted automatically when you stop the lab or the session ends. Nothing is billed to you by AWS.
How long does the Incident: Finance Reports Fail With KMS AccessDenied lab take?
Plan for about 60 minutes. The session timer is shown on screen, and every task is checked against your live AWS account when you click Verify.
How do I get access to this lab?
It is included in the AWS Troubleshooting – Advanced plan: a one-time payment for every lab in the path, 2 attempts per lab and a 7-day money-back guarantee. You can also start with the 5 free labs.
Does this lab help with the AWS Troubleshooting – Advanced exam?
Yes. It is part of the AWS Troubleshooting – Advanced path, which covers the hands-on skills behind the exam. Doing the task in a real account is what makes the questions easier to reason about.
Related AWS labs
- Incident: Private Data Lake Reader Can't Reach S3
- Incident: Event Recorder Hangs Writing to DynamoDB
- Incident: One Bad Payment Blocks the Settlement Queue
- Incident: Payments Return 502 Bad Gateway After Deploy
- Incident: Private Workers Have No Internet Despite a NAT Route
- Incident: Order Audit Events Silently Disappear