Question

A financial services company runs a data ingestion pipeline where a producer account (111122223333) must encrypt objects it uploads to an S3 bucket in a central account (444455556666) using a customer managed KMS key owned by the central account. Per the company's data classification policy, the producer must never be able to decrypt or read the data it writes — only the central analytics team may decrypt. A security engineer needs to grant the producer account the minimum access required. Which approach correctly enforces this requirement?

Accepted Answer

Add a statement to the central KMS key policy allowing the producer account principal to call kms:GenerateDataKey and kms:Encrypt only, and do not grant kms:Decrypt; grant kms:Decrypt separately to the analytics team's role.

Answer

Add a statement to the central KMS key policy granting the producer account kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey, then use an SCP in the producer's organization to deny kms:Decrypt.

Answer

Create a KMS grant for the producer account that includes the Encrypt, Decrypt, and GenerateDataKey operations, relying on the grant constraints to hide decrypted plaintext.

Answer

Enable automatic key rotation on the central KMS key so that the producer's data key becomes invalid after upload, preventing the producer from decrypting.