Account A owns a KMS CMK that encrypts objects in a shared evidence bucket. Account B’s application role must decrypt those objects. What must be configured?
Select an answer to reveal the explanation.
Short Explanation
Cross-account decrypt needs the key policy to invite Account B’s role—plus that role’s IAM allowing Decrypt. You do not hand-copy key bytes or blast AdministratorAccess. Public buckets skip the security model entirely.
Full Explanation
Cross-account use of a CMK requires the key policy in the owning account to allow the external principal, and the caller’s IAM policy must permit the KMS actions. S3 object access alone is insufficient when objects are SSE-KMS encrypted. Recreating key material manually, granting account-wide admin, or making the bucket public are incorrect approaches.