You use a customer managed AWS KMS key (CMK) to encrypt objects in an S3 bucket using SSE-KMS. A specific IAM role must be able to decrypt objects. Where should you grant kms:Decrypt permissions so that the role can decrypt data encrypted with that CMK?

Only in the S3 bucket policy by granting s3:GetObject, because S3 bucket policy controls decryption.

An S3 bucket policy can authorize s3:GetObject, but it does not grant KMS permission to decrypt a KMS-encrypted data key. KMS will still require key-policy (and IAM) authorization for kms:Decrypt on the CMK.

Only in the IAM role identity policy; the KMS key policy does not need changes for SSE-KMS.

For customer-managed keys, a restrictive CMK key policy can deny or omit access. In that case, identity-policy kms:Decrypt permission alone is insufficient because the key policy is also evaluated and must allow the role to use the key for decryption.

By enabling S3 default encryption; KMS permissions are automatically granted to all IAM roles in the account.

Default encryption only ensures objects are encrypted with the specified CMK when written. It does not grant decrypt permissions to other principals. Roles must be explicitly authorized to use the CMK.

What does this SAA-C03 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: In the KMS key policy, allowing kms:Decrypt (and any other required KMS permissions) for the role’s principal ARN. — For SSE-KMS, decryption requires authorization in KMS for the specific CMK. The CMK key policy is a key authorization layer that must allow the role to use the key for decryption (at least kms:Decrypt, plus any additional required KMS permissions depending on configuration). While the IAM role also needs appropriate identity-policy permissions, the most important place to grant kms:Decrypt for SSE-KMS—so that KMS will permit decrypt—is the CMK key policy. Bucket policy alone cannot replace KMS authorization. Why others are wrong: Option B is incorrect because granting s3:GetObject in the bucket policy does not authorize kms:Decrypt on the CMK. Option C is incorrect because identity-policy permission may still be blocked by a restrictive key policy. Option D is incorrect because default encryption does not expand access; it only affects how new objects are encrypted.

What should I do if I get this SAA-C03 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.