An application encrypts data directly with AWS KMS using an encryption context. Your KMS key policy includes a condition that allows kms:Decrypt only when the encryption context contains: "purpose" = "myapp-secrets" After a deployment, decryption fails. CloudTrail shows kms:Decrypt was called, but it was denied by the key policy due to the encryption context condition. What is the best fix?

Add kms:Decrypt to the IAM role attached to the application without changing the key policy.

IAM permissions alone are insufficient because the key policy also restricts kms:Decrypt using encryption context conditions.

Disable the encryption context condition in the KMS key policy to avoid future failures.

Removing the condition weakens the intended security boundary and violates the reason the condition was added in the first place.

Rotate the KMS key immediately and re-encrypt all secrets with a different key ID.

Key rotation and re-encryption are disruptive and not required to address a mismatch in the encryption context used for decrypt.

What does this SAA-C03 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Update the application code to supply the correct encryption context "purpose" = "myapp-secrets" when calling decrypt (and encrypt if rotating). — When an application uses AWS KMS directly and the key policy restricts kms:Decrypt based on encryption context (for example, purpose=myapp-secrets), KMS will only authorize decrypt requests that include the exact required key/value pairs. The IAM role can have kms:Decrypt permission, but the key policy condition will still deny if the encryption context differs. The correct fix is to update the application to supply the same encryption context during decrypt (and during encrypt if new ciphertext is created). This preserves strong cryptographic separation without relaxing KMS controls. Option B fails because key policy conditions are enforced even if IAM allows the action. Option C removes a security control meant to bind ciphertext to a specific use case, increasing risk. Option D is likely unnecessary and costly: the failure is caused by the encryption context mismatch, not by key age or key identity.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.