A company in Account A encrypts its analytics reports with a customer managed KMS key. A data science team in Account B must decrypt those reports, and Account B can already read the bucket that holds them. What must be in place for Account B's decryption calls to succeed?
Show answer and explanation
Answer: C
Decrypting an object encrypted under a customer managed key requires permission at two layers when the caller is in another account. The key policy in the owning account must allow Account B, or a principal there, to use the key. The calling principal in Account B must also have an identity policy that allows kms:Decrypt on that key's ARN. Bucket read access alone is not enough, because S3 only delivers ciphertext and the key must still be usable.
Why the other options are wrong
- A. The key policy is necessary but not sufficient. Account B's own IAM principals also need an identity policy allowing kms:Decrypt on the key, and bucket read access does not grant any key usage rights.
- B. AWS-owned keys are managed by AWS and cannot be granted to another account or swapped in to fix cross-account access. Switching would also remove the customer control the company requires.
- D. Bucket policies control access to S3 objects, not KMS operations. kms:Decrypt is evaluated against the key policy and the caller's identity policy, so it cannot be granted through a bucket policy.