Question

A company runs a data-processing Lambda function that must decrypt objects protected by a customer managed KMS key only during a nightly batch job. The security team wants to grant the Lambda execution role temporary, least-privilege decrypt access without modifying the key policy each time and without leaving standing permissions that must be manually removed. The key policy already delegates permissions management to IAM. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant to the Lambda execution role that allows the Decrypt operation, and retire the grant when the batch job completes.

Answer

Add the Lambda execution role as a principal with kms:Decrypt in the key policy, then remove it after each run.

Answer

Attach an IAM policy to the Lambda execution role that permanently allows kms:Decrypt on the key.

Answer

Enable automatic key rotation so a new key version is available for each nightly job.