Question

A company runs a data-processing pipeline where a temporary Lambda function must decrypt objects encrypted with a customer managed KMS key for a 48-hour batch job. Security requires that the Lambda's access to the key be scoped, temporary, and revocable without modifying the key policy or the Lambda execution role's IAM policy. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant for the Lambda execution role principal that permits the Decrypt operation, and retire the grant when the batch job completes.

Answer

Add a statement to the KMS key policy allowing the Lambda execution role to call Decrypt, then remove the statement after the job finishes.

Answer

Attach an inline IAM policy to the Lambda execution role granting kms:Decrypt, and delete the policy after 48 hours.

Answer

Enable automatic key rotation on the KMS key so the Lambda temporarily gains decrypt access during the rotation window.