Question

A financial services company stores sensitive customer records in an Amazon RDS database encrypted with a customer managed KMS key. The security team wants to enforce a data classification policy that guarantees the KMS key used to encrypt this data can ONLY be used to protect data at rest and is never used for signing or MAC operations, regardless of any future key policy changes. Which approach BEST enforces this constraint at the KMS layer?

Accepted Answer

Create the KMS key as a symmetric encryption key (key usage ENCRYPT_DECRYPT), since key usage and key spec are set at creation time and are immutable.

Answer

Add a key policy statement that denies kms:Sign and kms:GenerateMac actions for all principals.

Answer

Attach an SCP to the organization denying kms:Sign and kms:Verify on the key ARN.

Answer

Enable automatic key rotation so that new key material cannot be repurposed for signing operations.