Question

A SysOps administrator must prove to auditors that a specific Lambda function is the only workload decrypting sensitive records with a customer managed KMS key, and that each decryption request can be tied to a particular tenant. The team currently uses a shared symmetric CMK. Which approach best meets these requirements with the least custom code?

Accepted Answer

Have the Lambda function pass an encryption context (e.g., tenant ID) on every Encrypt and Decrypt call, restrict the key policy/IAM to the Lambda role, and review the encryption context recorded in AWS CloudTrail.

Answer

Enable automatic key rotation on the CMK and rely on the rotated key versions to distinguish each tenant's decryption requests in CloudTrail.

Answer

Store each tenant's data key in AWS Secrets Manager and grant the Lambda function read access, using Secrets Manager rotation to audit access per tenant.

Answer

Create a separate IAM user for each tenant with inline decrypt permissions and require the Lambda function to assume the matching user before decrypting.