Question

A financial services company uses a customer managed KMS key to encrypt sensitive datasets in S3. A data-processing application running on EC2 assumes an IAM role that needs to decrypt objects only during a nightly batch window. The security team wants to grant the least-privileged, time-scoped decrypt access without editing the KMS key policy each time, and they want the ability to revoke access programmatically the moment the batch completes. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant for the EC2 role's principal that permits only the Decrypt operation with an encryption context constraint, and call RetireGrant when the batch job finishes.

Answer

Add the EC2 role as a principal in the KMS key policy with kms:Decrypt allowed, and remove it from the policy after each batch run.

Answer

Attach an IAM policy to the EC2 role allowing kms:Decrypt on all keys, and use an SCP to deny access outside the batch window.

Answer

Enable automatic key rotation on the KMS key so the decrypt permission expires when the key material rotates.