Restrict KMS Key Decrypt to a Specific IAM Role

• A.KMS grant that gives the IAM role decrypt permissions for the key
• B.IAM policy attached to the role that allows kms:Decrypt for the key
• C.S3 bucket policy that denies decrypt unless the requester is the specific IAM role
• ✓ D.KMS key policy with a condition that the principal must be the specific IAM role

Why D: Option D is correct because KMS key policies are the main mechanism to control access to KMS keys. By specifying the IAM role as the principal in a key policy statement for the kms:Decrypt action, only that role can decrypt using the key. Option A is incorrect because KMS grants are intended for temporary or cross-account access and are not the best practice for permanent control. Option B is incorrect because IAM policies alone are not sufficient if the key policy does not allow the role; both policies must align. Option C is incorrect because S3 bucket policies control access to S3 operations, not KMS decryption permissions directly.

• A.Use an S3 access point policy to restrict access
• B.Attach an IAM policy to the role that allows kms:Decrypt with a condition on the source IP
• C.Create a KMS grant for the IAM role with Decrypt permission
• ✓ D.Add a bucket policy with a condition that the kms:ViaService is s3.amazonaws.com

Why D: Option D is correct because the bucket policy can include a condition using the kms:ViaService condition key set to s3.amazonaws.com, which ensures that decryption requests must come through S3. This allows only requests that originate from S3 (e.g., when the IAM role accesses the bucket) to decrypt, provided the role also has kms:Decrypt permission. Option A is incorrect because S3 access point policies control access to the access point, not KMS decryption. Option B is incorrect because source IP conditions do not restrict decryption to S3; they restrict based on IP address, which is not the requirement. Option C is incorrect because a KMS grant is typically used to delegate temporary access to another AWS principal, not to restrict a specific IAM role; a key policy with a principal condition is more appropriate.

• A.Attach an IAM policy to the role that allows kms:Decrypt, and leave the KMS key policy with default settings.
• B.In the key policy, use a Principal element specifying the role ARN, and allow kms:Decrypt.
• C.Use a grant for the role to allow kms:Decrypt for S3 operations.
• ✓ D.In the key policy, use a Condition block with kms:ViaService set to s3.<region>.amazonaws.com and allow kms:Decrypt for the role.

Why D: Option D is correct because using a kms:ViaService condition in the key policy restricts the key usage to requests coming from Amazon S3, and the IAM role's permissions to decrypt are granted via the key policy, ensuring only that role can decrypt via S3. Option A is wrong because without the key policy granting decrypt to the role, the IAM policy alone is insufficient. Option B is wrong because it grants blanket decrypt access to the role without the S3 service restriction, allowing decryption outside S3. Option C is wrong because grants are not the recommended way to control access for IAM roles with S3; key policies with conditions are more appropriate.