Question

A security engineer manages a single KMS customer managed key used by multiple project teams. The compliance team requires that each team can only use the key to encrypt/decrypt data associated with their own project, distinguished by a request tag. The engineer wants to control this authorization through the KMS key policy without creating a separate key per team. Which approach correctly enforces per-team access using KMS cryptographic operations?

Accepted Answer

Add a key policy statement allowing kms:Encrypt and kms:Decrypt with a condition on kms:EncryptionContext that must match the caller's project identifier.

Answer

Create a separate KMS alias for each team and add a key policy condition on kms:RequestAlias so teams can only invoke the key through their own alias.

Answer

Enable automatic key rotation and rely on the rotated key versions to separate each team's ciphertext.

Answer

Attach a resource-based policy to the ciphertext objects in S3 referencing each team's IAM role for decrypt permission.