Question

A data engineering team in Account A runs a Glue job that must read Parquet files stored in an S3 bucket owned by Account B. The objects in Account B are encrypted with a customer-managed KMS key (also in Account B). The bucket policy already grants Account A's Glue role s3:GetObject. However, the Glue job fails with an AccessDenied error when attempting to decrypt objects. What is the MOST appropriate action to resolve this while following least-privilege principles?

Accepted Answer

Add a statement to the KMS key policy in Account B that grants the Glue role in Account A kms:Decrypt permission, and attach an IAM policy in Account A allowing the Glue role kms:Decrypt on that key ARN.

Answer

Change the S3 objects in Account B to use SSE-S3 (Amazon S3-managed keys) instead of SSE-KMS so no key permissions are needed.

Answer

Grant the Glue role in Account A full administrative access to KMS by attaching the AWS managed AWSKeyManagementServicePowerUser policy.

Answer

Copy the KMS key from Account B into Account A and re-encrypt all objects so the Glue role can use a local key.