Question

A company granted a partner's AWS account temporary access to decrypt objects protected by a customer managed KMS key. Access was originally provisioned using a KMS grant created by a Lambda function. The partnership has now ended, and the security team must ensure the partner can no longer perform any Decrypt operations with the key as quickly as possible, without impacting the many internal applications that continue to use the same key. Which action BEST meets this requirement?

Accepted Answer

Retire or revoke the KMS grant that was issued to the partner account's principal.

Answer

Schedule deletion of the KMS key and create a new key for internal applications.

Answer

Enable automatic key rotation so the partner's cached key material becomes invalid.

Answer

Remove the partner's account from the key policy's key administrators statement.