Question

A company uses a customer managed KMS key to encrypt sensitive data. A newly deployed Lambda function must temporarily be granted permission to decrypt objects with this key for a scheduled 6-hour batch job, after which the access should be automatically revoked without modifying the key policy or the function's IAM role. A SysOps administrator wants the least disruptive, auditable way to provide this scoped, revocable permission. Which approach BEST meets these requirements?

Accepted Answer

Create a KMS grant that specifies the Lambda execution role as the grantee principal and includes only the Decrypt operation, then retire the grant when the job completes.

Answer

Add a statement to the KMS key policy allowing the Lambda execution role to call Decrypt, then remove the statement after the job finishes.

Answer

Attach an inline IAM policy to the Lambda execution role permitting kms:Decrypt and delete it once the batch job completes.

Answer

Enable automatic key rotation on the KMS key so the Lambda function receives temporary decrypt permissions during the rotation window.