Question

A financial services company stores encrypted objects in an S3 bucket using an SSE-KMS customer managed key. A newly created AWS Lambda function (assuming an execution role) needs to read and decrypt these objects, but developers report AccessDenied errors on kms:Decrypt even though the Lambda execution role has an identity-based policy granting kms:Decrypt on the key. The KMS key policy currently contains only a statement granting the account root full access. What is the MOST likely cause and the correct fix that follows least privilege?

Accepted Answer

The key policy must be updated to explicitly grant the Lambda execution role kms:Decrypt, or the existing root statement must remain to allow IAM identity-based policies to take effect for principals in the account.

Answer

The Lambda function cannot use customer managed keys; it must be reconfigured to use an AWS managed key (aws/lambda) instead.

Answer

Key rotation must be enabled on the customer managed key so that Lambda can decrypt newly written objects.

Answer

An S3 bucket policy must grant the Lambda role kms:Decrypt, since KMS permissions for S3 objects are evaluated through the bucket policy.