Question

A security engineer manages a KMS customer managed key used by multiple applications to encrypt sensitive financial records. Compliance requires that (1) the key can only be used over encrypted connections and (2) applications must supply a specific encryption context tag so decrypt operations can be scoped and audited. Which combination of key policy conditions enforces both requirements on Decrypt operations?

Accepted Answer

Add a Deny statement with condition "Bool": {"aws:SecureTransport": "false"} and an Allow statement with condition "StringEquals": {"kms:EncryptionContext:project": "finance"}

Answer

Add an Allow statement with condition "Bool": {"aws:SecureTransport": "true"} and "StringEquals": {"aws:RequestTag/project": "finance"}

Answer

Enable automatic key rotation and add condition "StringEquals": {"kms:ViaService": "s3.amazonaws.com"}

Answer

Add a Deny statement with condition "Null": {"kms:EncryptionContext": "true"} and rely on default TLS enforcement by KMS