Design Secure Architectures · difficulty 2
An engineer grants an IAM role s3:GetObject and kms:Decrypt in its identity-based policy, expecting it to read SSE-KMS-encrypted objects. The role still gets AccessDenied on decrypt. The customer managed KMS key's key policy is shown below. What is missing?
kms-key-policy.json
{ "Version": "2012-10-17", "Statement": [{ "Sid": "EnableRootAccountAdmin", "Effect": "Allow", "Principal": {"AWS": "arn:aws:iam::123456789012:root"}, "Action": "kms:*", "Resource": "*" }]}