A finance team requires that only a dedicated key-admin role may schedule deletion of a customer managed KMS key used by tax systems, while application roles may only encrypt and decrypt data. Which design best enforces that separation?
Select an answer to reveal the explanation.
Short Explanation
App roles get the “use the lock” permission; only key-admins get the “schedule throwing away the lock” permission. That key-policy split keeps tax crypto users from deleting tomorrow’s keys.
Full Explanation
Least-privilege KMS key policies separate key users (encrypt/decrypt/generate data key) from key administrators (enable rotation scheduling, schedule deletion, put key policy). Embedding ScheduleKeyDeletion only for a key-admin role implements that control. Broad kms:* for everyone or public key material violates least privilege and finance change-control expectations.