Cross-Account KMS Key Access: Key Policy & IAM Permissions
A central security account stores encrypted log files in S3 using a customer managed AWS KMS key. A partner account already has S3 bucket access through an assumed role and now must also be able to encrypt and decrypt objects that use the same KMS key. Which two actions are required? Select two.
Quick Answer
The answer is that you must attach IAM permissions in the partner account for kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey on the CMK, and also update the KMS key policy in the central account to grant the partner account or its assumed role explicit access. This is required because cross-account KMS key access relies on a two-part authorization model: the key policy must allow the external principal, and that principal must have matching IAM permissions in their own account to invoke the cryptographic operations. On the SAA-C03 exam, this scenario tests your understanding that S3 bucket access alone does not imply KMS key access—a common trap is assuming the partner’s S3 role automatically inherits encryption permissions. The key policy acts as the resource-based gatekeeper, while the partner’s IAM policy provides the identity-based permission; both must align for the decrypt or encrypt call to succeed. Memory tip: think “Key Policy + IAM = Cross-Account Key Access.”
⚠ Common exam trap
The trap here is that candidates often forget that cross-account KMS access requires both a key policy update in the central account AND IAM permissions in the partner account, not just one of them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Update the KMS key policy to allow the partner role or account to use the key.
The KMS key policy must explicitly grant the partner account or role permission to use the key for cryptographic operations. Without this cross-account policy statement, the key remains inaccessible to the partner account, even if the partner has S3 bucket access. This is a fundamental requirement for cross-account KMS key usage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Update the KMS key policy to allow the partner role or account to use the key.
Why this is correct
KMS evaluates the key policy before permitting use of a customer managed key. Cross-account use requires the key policy to trust the external principal or a grant to that principal.
- ✗
Enable automatic key rotation to solve the cross-account access requirement.
Why it's wrong here
Key rotation improves cryptographic hygiene, but it does not grant permissions to another account. Access control is handled by policies or grants, not rotation settings.
- ✓
Attach IAM permissions in the partner account for kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey on the CMK.
Why this is correct
The partner role also needs IAM permission to call KMS actions against the key. Cross-account KMS access requires both an identity policy and a key policy or grant.
- ✗
Replace the CMK with the AWS managed key alias/aws/s3.
Why it's wrong here
AWS managed keys are not designed for this kind of cross-account sharing model. They also do not give the same policy control as a customer managed KMS key.
- ✗
Export the KMS key material and share it with the partner account.
Why it's wrong here
Exporting key material is not a normal or recommended pattern for KMS access. It undermines the service model and is unnecessary when key policy and IAM permissions are available.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAA-C03
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A central security account stores encrypted log files in S3 using a customer managed AWS KMS key. A partner account already has S3 bucket access through an assumed role and now must also be able to encrypt and decrypt objects that use the same KMS key. Which two actions are required? Select two.
medium- ✓ A.Update the KMS key policy to allow the partner role or account to use the key.
- B.Enable automatic key rotation to solve the cross-account access requirement.
- ✓ C.Attach IAM permissions in the partner account for kms:Encrypt, kms:Decrypt, and kms:GenerateDataKey on the CMK.
- D.Replace the CMK with the AWS managed key alias/aws/s3.
- E.Export the KMS key material and share it with the partner account.
Why A: The KMS key policy must explicitly grant the partner account or its assumed role permission to use the key for cryptographic operations. Without this cross-account policy statement, the partner account cannot access the key even if it has IAM permissions, as KMS key policies are the primary access control mechanism for cross-account usage.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.