Question

A financial services company encrypts sensitive customer records in an S3 bucket using a customer managed KMS key. A newly deployed analytics application running on EC2 instances (using an instance profile role) must decrypt these objects only between 01:00 and 05:00 UTC each day when batch jobs run. The security team wants to grant the minimum necessary access without modifying the KMS key policy, which is centrally controlled and change-controlled by a separate team. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant for the EC2 instance role with the Decrypt operation, and add a time-based condition to the analytics application's IAM policy restricting kms:Decrypt to the 01:00-05:00 UTC window.

Answer

Add the EC2 instance role as a principal in the KMS key policy with a DateGreaterThan/DateLessThan condition on the daily time window.

Answer

Create a KMS grant that includes a constraint limiting the grant to specific hours of the day so decryption only occurs during the batch window.

Answer

Attach an SCP to the account that denies kms:Decrypt outside the 01:00-05:00 UTC window and rely on the existing key policy for authorization.