A county grants portal shares a KMS customer managed key with a par…

Question

A county grants portal shares a KMS customer managed key with a partner AWS account so the partner can decrypt grant packages in S3. The partner must not administer the key, create grants for others, or change the key policy. What should the city grant?

Accepted Answer

kms:Decrypt (and encrypt if needed) through a key policy or IAM statement that allows use without key-administration actions — Think of the CMK like a city vault: partners get a checkout slip for Decrypt, not the master keys to rewrite the vault rules. Least-privilege KMS usage (encrypt/decrypt) is separate from key-admin rights like changing policies or scheduling deletion.

Answer

kms:CreateKey and kms:PutKeyPolicy so the partner can mint a second CMK for their decrypt workflow

Answer

kms:ScheduleKeyDeletion so the partner can retire compromised ciphertext without city involvement

Answer

AdministratorAccess in the city account so the partner console can open any KMS key

A county grants portal shares a KMS customer managed key with a partner AWS account so the partner can decrypt grant packages in S3. The partner must not administer the key, create grants for others, or change the key policy. What should the city grant?

Short Explanation

Full Explanation