Question

A developer creates a customer managed KMS key to encrypt sensitive financial records stored in an S3 bucket. Company policy requires that only a specific IAM role named DataProcessorRole be able to decrypt these records, and no other principal in the account — including administrators — should be able to perform Decrypt operations. The key must still allow account administrators to manage the key (update policy, schedule deletion). What is the correct way to enforce this decrypt restriction?

Accepted Answer

In the key policy, grant kms:Decrypt only to DataProcessorRole, and grant administrative permissions (like kms:PutKeyPolicy, kms:ScheduleKeyDeletion) separately to the admin principals without kms:Decrypt.

Answer

Attach an identity-based policy to DataProcessorRole allowing kms:Decrypt, and rely on the default key policy that grants the root account full access to the key.

Answer

Enable automatic key rotation on the KMS key so that only DataProcessorRole retains access to the current key version.

Answer

Create a KMS grant for DataProcessorRole with the Decrypt operation and remove the key policy entirely so no other principal has access.