Question

A company encrypts objects in an S3 bucket in Account A using a customer managed KMS key. A data-analytics application running under an IAM role in Account B must be able to read and decrypt these objects. The security team wants to grant the minimum access required and follow AWS best practices for cross-account KMS access. Which combination of configuration steps correctly enables Account B to decrypt the objects?

Accepted Answer

In the KMS key policy in Account A, add a statement allowing the Account B role kms:Decrypt; in Account B, attach an IAM policy allowing kms:Decrypt on the key ARN; and grant the role s3:GetObject on the bucket.

Answer

Enable automatic key rotation on the KMS key and add the Account B role as a key administrator in the key policy.

Answer

Attach an IAM policy to the Account B role allowing kms:Decrypt on the key ARN; no changes to the key policy in Account A are needed because IAM policies override key policies across accounts.

Answer

Share the KMS key with Account B using AWS Resource Access Manager (RAM) and enable S3 Bucket Keys on the bucket.