Question

A financial services company encrypts sensitive customer records in an S3 bucket using a customer managed KMS key. Security policy requires that decryption of these records is only possible from within the company's VPC, using a VPC endpoint for KMS, and never from the public internet or other networks. Application EC2 instances in private subnets access the data through an interface VPC endpoint for KMS. Which approach best enforces this requirement?

Accepted Answer

Add a condition to the KMS key policy that denies kms:Decrypt unless the request originates through the specific KMS VPC endpoint, using the aws:sourceVpce condition key.

Answer

Attach a bucket policy to the S3 bucket that denies s3:GetObject requests unless they come from the VPC endpoint for S3.

Answer

Enable automatic key rotation on the KMS key and restrict the key alias to the VPC using a resource tag condition.

Answer

Create a KMS grant scoped to the EC2 instance role and remove all key policy statements so only the grant controls access.