In Company B's IAM policy, allow kms:Encrypt on Company A's KMS key ARN, without changing Company A's key policy.

KMS key policies govern access to the key; adding permissions in the caller account alone cannot override a restrictive key policy in the key owner account.

Create a new KMS key in Company B and configure Company A's S3 bucket to use that key for SSE-KMS.

Switching bucket ownership encryption to a partner key changes trust boundaries and operational ownership. It also doesn't directly resolve the original denial and can complicate key administration.

Disable key policy restrictions by setting the KMS key to enabled and removing all policy statements so that encryption automatically works for any principal.

Removing restrictions or effectively allowing all principals defeats security objectives and is not required for cross-account access. Key policies should be explicit and least-privilege.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: In Company A's KMS key policy, allow Company B's partner role principal to use the key for kms:Encrypt, kms:GenerateDataKey, and kms:DescribeKey, and also add a matching IAM policy in Company B that grants the partner role those same KMS actions on Company A's key ARN, constrained to the target S3 bucket context when possible. — With SSE-KMS, S3 relies on KMS authorization for encrypting uploaded objects. For a cross-account caller, the partner role in Company B must be allowed in its own IAM policy to use the key, and the KMS key policy in Company A must also trust that external principal or account. Grant only the required KMS actions and scope them to the specific workload or encryption context for least privilege. Why others are wrong: Option B fails because KMS key policy is authoritative; caller IAM permissions alone cannot grant access if the key policy blocks it. Option C changes the encryption key ownership model and does not directly resolve the cross-account permission issue; it also introduces additional operational trust complexity. Option D weakens security by removing restrictions, which is unnecessary and violates least-privilege practices.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.