Question

A security engineer is designing envelope encryption for a multi-tenant SaaS application. Each tenant's data is encrypted with a shared AWS KMS customer managed key. The engineer wants to ensure that ciphertext encrypted for one tenant cannot be decrypted while claiming a different tenant's identity, without creating a separate KMS key per tenant. Which approach best achieves this cryptographic binding?

Accepted Answer

Pass an encryption context containing the tenant ID on every Encrypt and Decrypt call, and enforce the matching context in the KMS key policy conditions.

Answer

Store each tenant ID as a resource tag on the KMS key and rely on ABAC to isolate decrypt operations.

Answer

Enable automatic key rotation so each tenant receives a distinct backing key version.

Answer

Use a KMS grant per tenant that includes the tenant ID in the grant name to scope decryption.