Question

A security engineer manages a customer managed KMS key used to encrypt data in a shared analytics pipeline. A short-lived Lambda function, running under a role that is created dynamically for each batch job, must be granted temporary permission to decrypt data with the key. The engineer wants to avoid editing the key policy or IAM policies for every ephemeral role, and wants the permission to be easily and programmatically revocable when the job finishes. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant that specifies the ephemeral role as the grantee principal with the Decrypt operation, and call RetireGrant or RevokeGrant when the job completes.

Answer

Add a statement to the KMS key policy allowing kms:Decrypt for each ephemeral role ARN, and remove the statement after the job finishes.

Answer

Attach an identity-based IAM policy allowing kms:Decrypt to each ephemeral role as it is created, then delete the policy at job completion.

Answer

Enable automatic key rotation and rely on the rotated key version to limit how long any decrypt permission remains valid.