Question

A developer maintains a document-processing microservice that runs under an IAM role. The service must temporarily allow a short-lived worker process (running under a different IAM role) to encrypt documents using a specific customer managed KMS key, but only for the duration of a single processing job. The security team requires that no changes be made to the KMS key policy and that the delegated permission can be programmatically revoked when the job completes. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant on the key that specifies the worker role as the grantee principal with the Encrypt operation, then call RetireGrant when the job finishes.

Answer

Add a statement to the KMS key policy granting the worker role kms:Encrypt, then remove the statement after the job completes.

Answer

Attach an identity-based IAM policy to the worker role granting kms:Encrypt on the key, then detach the policy when the job completes.

Answer

Use STS AssumeRole so the worker assumes the document-processing service role, inheriting its KMS permissions for the job.