Question

A security engineer is designing envelope encryption for an application that stores sensitive customer records in Amazon S3 using SSE-KMS with a customer managed key. Compliance requires that a decryption request only succeeds if it is tied to the same logical tenant that performed the encryption, so that a valid ciphertext for one tenant cannot be decrypted in the context of a different tenant. The engineer wants to enforce this cryptographically without creating a separate KMS key per tenant. Which approach BEST meets this requirement?

Accepted Answer

Pass an encryption context containing the tenant identifier on Encrypt and Decrypt calls, and add a KMS key policy condition on kms:EncryptionContext to require the matching tenant value.

Answer

Enable automatic annual key rotation on the KMS key so each tenant's data is protected by a distinct backing key version.

Answer

Use a KMS grant with an encryption context constraint that is generated at runtime for each request without recording the tenant identifier.

Answer

Store the tenant identifier in the S3 object metadata and validate it in the application before returning decrypted data.