Separate data access from key access, then prove it

short · 55 min · Objective 2.2

Task

Configure a customer-managed key so that permission on the data is insufficient without permission on the key, and demonstrate the refusal.

Steps

  1. Create a customer-managed key with an explicit key policy, and encrypt a storage resource with it.
  2. Create an identity with full permissions on the DATA and none on the key. Attempt to read an object with it and capture the refusal in lab/key-separation.txt.
  3. Grant the identity key-use permission, read successfully, and capture that too -- the pair is the evidence.
  4. Disable the key and attempt the read again, capturing the result in lab/key-disabled.txt. Re-enable and confirm the read works, demonstrating that disable is reversible and destroy is not.
  5. Export the key's audit trail showing each use, and write lab/key-audit.md naming which identity decrypted what and when.

Verify

grep -Eic 'denied|accessdenied|forbidden|not authorized' lab/key-separation.txt
grep -Eic 'denied|disabled|keyunavailable' lab/key-disabled.txt
grep -Ec '[0-9]' lab/key-audit.md

A refusal captured for the data-only identity, a refusal captured while the key was disabled, and an audit trail with real entries. The audit trail is frequently the most valuable property of customer-managed keys and the one people forget they have bought.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.