Question

A financial services company stores customer records in an S3 bucket encrypted with a customer managed KMS key in Account A. A partner analytics firm operating in Account B must be able to decrypt and read these objects, but must NOT be able to schedule deletion of the key, change the key policy, or create grants on the key. The security team wants to grant the minimum access using the KMS key policy while allowing Account B's own IAM administrators to delegate the decrypt permission to specific roles. Which approach meets these requirements?

Accepted Answer

In the KMS key policy, add a statement allowing the Account B root principal (arn:aws:iam::AccountB:root) the kms:Decrypt and kms:DescribeKey actions, then have Account B attach IAM policies granting those actions to specific roles.

Answer

In the KMS key policy, add a statement allowing specific Account B IAM roles all kms:* actions, relying on Account B IAM policies to further restrict which roles can use the key.

Answer

Create a KMS grant that gives the Account B root principal kms:Decrypt, kms:CreateGrant, and kms:ScheduleKeyDeletion so Account B can manage its own delegation.

Answer

Enable automatic key rotation and share the key's backing key material with Account B so the partner can decrypt objects independently without cross-account policy changes.