A data-processing service needs to use a KMS key for a limited period.
Avoid permanently broadening the key policy and limit the cryptographic operations that the service can perform.
Which KMS feature is most appropriate?
Use a KMS grant to delegate selected cryptographic operations to the processing service without making a permanent broad policy change.
Detailed explanation
Public key access removes confidentiality and violates least privilege.
Public key access removes confidentiality and violates least privilege.
Root credentials are not a KMS delegation mechanism and must not be shared.
Root credentials are not a KMS delegation mechanism and must not be shared.
A grant delegates specified KMS operations to a principal and can be managed separately from the long-term key policy.
A grant delegates specified KMS operations to a principal and can be managed separately from the long-term key policy.
An S3 ACL controls object access and cannot grant permission to use a KMS key.
An S3 ACL controls object access and cannot grant permission to use a KMS key.
Check official documentation
Compare the following points with the official documentation.
AWS KMS grantsの公式説明を確認する。
What to confirm
キー利用権限の委任と、S3リソース権限の違いを説明できる。
Key points
- KMS grant
- Cryptographic operation
- Delegation
Notes
- Environment: AWS公式KMSドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Scoped authorization
A grant can expose only the required operations to the processing service without making the key broadly public.
Independent permissions
An S3 ACL does not replace the KMS authorization needed to use the encryption key.