Sensitive S3 data is encrypted with customer-specific KMS keys.
An analytics role may decrypt only its customer's data.
Which authorization approach is most appropriate?
Separate key policies and IAM permissions by customer and constrain kms:Decrypt with EncryptionContext.
Detailed explanation
KMS does not automatically authorize by file name.
KMS does not automatically authorize by file name.
Encryption would not limit cross-customer access.
Encryption would not limit cross-customer access.
Key, principal, and dataset context jointly constrain decryption.
Key, principal, and dataset context jointly constrain decryption.
Post-access deletion does not prevent decryption.
Post-access deletion does not prevent decryption.
Check official documentation
Compare the following points with the official documentation.
AWS KMS key policies、kms:EncryptionContext、S3 SSE-KMSの公式説明を確認する。
What to confirm
暗号化されていることと、復号認可が最小権限であることを区別できる。
Key points
- KMS key policy
- kms:Decrypt
- EncryptionContext
- Customer isolation
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Encryption versus authorization
Ciphertext protection does not remove the need for a narrowly scoped decrypt permission.
Context consistency
The producer and consumer must generate the same context values and casing.