Question

A company stores sensitive data in an S3 bucket in Account A, encrypted with a customer managed AWS KMS key. An application running on EC2 instances in Account B must read and decrypt these objects. The bucket policy already grants Account B's IAM role s3:GetObject. However, the application receives an AccessDenied error when attempting to download objects. What must the CloudOps engineer do to resolve this while following least-privilege best practices?

Accepted Answer

Update the KMS key policy in Account A to grant the Account B IAM role kms:Decrypt permission, and attach an IAM policy in Account B allowing kms:Decrypt on that key ARN.

Answer

Enable S3 default encryption with SSE-S3 on the bucket so that no KMS permissions are required for cross-account access.

Answer

Add the Account B IAM role as an additional key administrator in the KMS key policy of Account A.

Answer

Create a bucket policy in Account B that grants kms:Decrypt on the Account A key ARN.