Question

A company uses a customer managed AWS KMS key to encrypt sensitive financial records stored in Amazon S3. The security team wants to ensure that a newly created IAM role used by a nightly batch job can decrypt objects, but only for the duration the job runs, without permanently modifying the KMS key policy or attaching broad IAM permissions. The team also wants the ability to programmatically retire this access when the job completes. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant that specifies the batch job's IAM role as the grantee principal with the Decrypt operation, and retire the grant when the job finishes.

Answer

Add a statement to the KMS key policy allowing the batch job's IAM role to perform kms:Decrypt, and remove the statement after the job completes.

Answer

Attach an IAM policy to the batch job's role granting kms:Decrypt on all keys in the account, and detach it when the job completes.

Answer

Enable automatic key rotation on the KMS key so the batch role can decrypt using the rotated key material temporarily.