Question

A company runs a data processing pipeline where a batch Lambda function must temporarily decrypt objects using a customer managed KMS key. The security team wants to grant this specific Lambda execution role decrypt permission on the key for the duration of the job without editing the KMS key policy and without granting broad, permanent access. The team also wants the ability to programmatically revoke the permission immediately when the job completes. What should the developer implement?

Accepted Answer

Create a KMS grant for the Lambda execution role principal that allows the Decrypt operation, and call RetireGrant or RevokeGrant when the job finishes.

Answer

Add the Lambda execution role ARN to the KMS key policy with kms:Decrypt, then remove it from the policy after the job completes.

Answer

Attach an identity-based IAM policy to the Lambda role granting kms:Decrypt on all keys, and detach it after the job completes.

Answer

Enable automatic key rotation on the customer managed key so the Lambda can decrypt only during the rotation window.