Question

A company runs a data-processing Lambda function that must temporarily decrypt objects using a customer managed KMS key owned by a separate analytics team. The analytics team wants to allow the Lambda's execution role to decrypt for the duration of a batch job without permanently editing the KMS key policy, and they want the ability to revoke the permission programmatically when the job completes. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant that gives the Lambda execution role the Decrypt operation, and retire or revoke the grant when the batch job finishes.

Answer

Add the Lambda execution role as a principal in the KMS key policy with kms:Decrypt, then remove it from the policy after the job.

Answer

Attach an IAM identity policy to the Lambda execution role allowing kms:Decrypt on the key, and detach it after the job.

Answer

Enable automatic key rotation on the KMS key so the Lambda can decrypt only during the rotation window.