Question

A developer is building a document-processing service where each customer's files are encrypted with a shared KMS customer managed key. A downstream Lambda function must be able to decrypt only files belonging to a specific tenant, identified by a tenant ID that is passed as encryption context during encryption. The team wants to grant the Lambda's execution role temporary decrypt permission that is scoped so it can only decrypt data encrypted with that tenant's encryption context, without editing the key policy. Which approach meets these requirements?

Accepted Answer

Create a KMS grant for the Lambda execution role that includes a GrantConstraints EncryptionContextEquals condition matching the tenant ID.

Answer

Add an IAM policy to the Lambda execution role allowing kms:Decrypt on the key with no additional conditions.

Answer

Modify the KMS key policy to add a statement allowing the Lambda role to call kms:Decrypt for all encryption contexts.

Answer

Enable automatic key rotation on the customer managed key so each tenant gets a unique backing key version.