Question

A company stores sensitive reports in an S3 bucket encrypted with a customer managed AWS KMS key in Account A. An analytics team operating in Account B needs to read and decrypt these objects using their IAM role. The bucket policy has already been updated to grant Account B's role s3:GetObject access, but the analytics team still receives an AccessDenied error when downloading objects. What is the MOST likely cause and correct remediation?

Accepted Answer

The KMS key policy in Account A does not grant Account B (or its role) kms:Decrypt permission; update the key policy to allow the external account and attach a matching IAM policy in Account B.

Answer

S3 bucket keys are not enabled; enable an S3 Bucket Key on the bucket to allow cross-account decryption.

Answer

The KMS key must be rotated so that Account B receives the new key material required for decryption.

Answer

Cross-account access is impossible with customer managed keys; migrate the objects to an AWS managed key (aws/s3) to allow Account B access.