A city IT team shares an encrypted AMI from the production account to a disaster-recovery account so operators can launch recovery instances. The AMI copy uses a customer managed KMS key. What must the architect grant so the DR account can launch instances from that shared AMI?
Select an answer to reveal the explanation.
Short Explanation
Sharing the AMI photo is not enough if the KMS lock still only trusts production. The DR account needs key permission to unwrap the volume when it boots. Bucket policies and “make it public” do not replace that key grant.
Full Explanation
Encrypted AMIs depend on the KMS key that protects their snapshots. Cross-account launch requires the destination account (or roles in it) to be allowed in the key policy or via grants so EBS can decrypt at launch. Sharing the AMI alone, opening public AMI access, or disabling encryption are not the correct controls for secure cross-account DR use of an encrypted AMI.