Question

A security engineer manages a single AWS KMS customer managed key used by multiple project teams in the same account. Compliance requires that a principal be allowed to call kms:Decrypt only when the data key was originally encrypted for that principal's own project, without creating a separate KMS key per team. Each project's EC2 instances assume a role tagged with Project=, and applications pass an encryption context of {"project":""} on every Encrypt call. Which approach enforces this requirement using one shared KMS key?

Accepted Answer

Add a key policy statement allowing kms:Decrypt with a condition that requires kms:EncryptionContext:project to equal the aws:PrincipalTag/Project value.

Answer

Create a separate KMS grant for each project team that constrains the GrantConstraints EncryptionContextSubset to the project name, and delete unused grants nightly.

Answer

Enable automatic key rotation and rely on the rotated backing key to isolate each project's ciphertext from other teams.

Answer

Add an IAM identity policy on each role allowing kms:Decrypt with a condition on kms:ViaService so only the project's EC2 instances can decrypt.