Question

A company encrypts objects in an S3 bucket in Account A using a customer managed KMS key. A data-processing application running under an IAM role in Account B must be able to decrypt these objects. The security team wants to grant this access following least privilege, allow the permission to be temporary, and enable it to be programmatically revoked when the processing job completes — without editing the KMS key policy or the S3 bucket policy each time. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant on the customer managed key that allows the Account B role the kms:Decrypt operation, and call RetireGrant or RevokeGrant when the job finishes.

Answer

Add the Account B role ARN as a principal with kms:Decrypt in the KMS key policy, then remove the statement when the job finishes.

Answer

Enable automatic key rotation on the customer managed key so Account B temporarily gains decrypt access during each rotation window.

Answer

Attach an identity-based policy in Account B granting kms:Decrypt on the key, and rely on Account A's default key policy to allow the cross-account call.