Question

A company runs a data ingestion service on EC2 that must encrypt objects before uploading them to S3 using a customer managed KMS key. A separate analytics service, running under a different IAM role, must be able to read and decrypt those objects. Security requires that the ingestion role can only encrypt (never decrypt) and the analytics role can only decrypt (never encrypt), enforced at the key. Which approach meets these requirements with least privilege?

Accepted Answer

In the KMS key policy, allow kms:Encrypt and kms:GenerateDataKey for the ingestion role and kms:Decrypt for the analytics role, scoping each statement to the respective role principal.

Answer

Grant both roles kms:Encrypt and kms:Decrypt in the key policy, and rely on S3 bucket policies to separate read and write access.

Answer

Use an asymmetric KMS key so the ingestion role uses the public key to encrypt and the analytics role uses the private key to decrypt automatically.

Answer

Attach identity-based IAM policies granting the appropriate KMS actions to each role and leave the KMS key policy with only the default root account statement.