Question

A developer is building a document management service that encrypts tenant files using AWS KMS. Each file belongs to a specific tenant, and the security team requires that a decryption request must fail if it does not specify the same tenant identifier that was used at encryption time, without creating a separate KMS key per tenant. Which approach satisfies this requirement?

Accepted Answer

Pass an encryption context containing the tenant ID in both the Encrypt and Decrypt calls so KMS validates it as additional authenticated data.

Answer

Create a KMS grant for each tenant that limits which principal can call Decrypt.

Answer

Store the tenant ID in the object metadata and validate it in application code before calling Decrypt.

Answer

Add a condition on the key policy that checks the tenant ID for every Decrypt request.