Question

A company stores sensitive reports in an S3 bucket in Account A, encrypted with a customer managed AWS KMS key. A partner team operating in Account B needs to read and decrypt these objects using an IAM role. The S3 bucket policy and the IAM role in Account B have both been configured to allow the required S3 and KMS actions, but the partner still receives an AccessDenied error when downloading objects. What must the solutions architect do to resolve the issue while following least-privilege principles?

Accepted Answer

Update the KMS key policy in Account A to grant the Account B role permission to call kms:Decrypt on the key.

Answer

Enable automatic key rotation on the customer managed key so the partner role can access the new key material.

Answer

Attach an SCP to Account B that allows kms:Decrypt on all keys in the organization.

Answer

Recreate the objects using SSE-S3 encryption so that no KMS permissions are required.