An IAM batch-processing role in the same account needs only Decrypt on data encrypted under an enabled symmetric encryption KMS key during a job. The encryption context contains only Job=job-104. There are no other permission paths or explicit denies.
Avoid permanent changes to key or IAM policies and permission redelegation. An approved administrator can create the grant and is designated as RetiringPrincipal. End the grant after completion and verify the outcome.
Which permission configuration and termination procedure meets the requirements?
Limit the key, processing role, Decrypt, and context through a grant, then explicitly end it and verify the permissions.
Detailed explanation
CreateGrant permits creation of new grants. Constraints are inherited, but delegation remains possible. Exclude this unnecessary permission and grant only the required decryption operation.
CreateGrant permits creation of new grants. Constraints are inherited, but delegation remains possible. Exclude this unnecessary permission and grant only the required decryption operation.
GrantId and GrantToken are distinct returned values. The ID identifies a grant; use the returned GrantToken with a supported operation to use new permissions before propagation.
GrantId and GrantToken are distinct returned values. The ID identifies a grant; use the returned GrantToken with a supported operation to use new permissions before propagation.
Temporary role credentials and grant lifetime are separate. Job completion or session expiry does not delete the grant; end it using RetireGrant or an appropriately authorized RevokeGrant operation.
Temporary role credentials and grant lifetime are separate. Job completion or session expiry does not delete the grant; end it using RetireGrant or an appropriately authorized RevokeGrant operation.
Limit the key, principal, operation, and context, and explicitly end the grant after use. If immediate use is needed, use the returned GrantToken; verify propagation and actual permissions when creating and ending the grant.
Limit the key, principal, operation, and context, and explicitly end the grant after use. If immediate use is needed, use the returned GrantToken; verify propagation and actual permissions when creating and ending the grant.
Check official documentation
Compare the following points with the official documentation.
With approved test keys and roles, verify Decrypt with the matching context, rejection of other contexts and extra operations, immediate use with GrantToken, and propagation after termination. Record GrantId and outcomes.
Official references
- Official documentation 1
- Official documentation 2
- Official documentation 3
- Official documentation 4
- Official documentation 5
What to confirm
Only Decrypt with the matching context is allowed, without redelegation. With no other permission paths, Decrypt is denied after termination propagates. Do not assume creation or termination is immediately consistent.
Key points
- KMS grant
- EncryptionContextEquals
- Grant token
Notes
- Environment: Official AWS KMS documentation and approved test keys and IAM roles
- Reviewed against the linked AWS documentation on 2026-10-12.
Foundation review
Limit the key, principal, operation, and context
Use a symmetric encryption key and IAM role with KeyId, GranteePrincipal, and Operations=Decrypt. Set EncryptionContextEquals to Job=job-104. Equals requires an exact context; Subset permits additional pairs. CreateGrant delegation is outside the requirements.
Separate temporary credentials from grant lifetime
Grants are considered with key and IAM policies and do not override a Deny. Session expiry and job completion do not terminate a grant. The designated RetiringPrincipal can use RetireGrant; distinguish administrator authorization for RevokeGrant. Ending a grant removes its permissions, not permissions from other policies.
Separate GrantId, GrantToken, propagation, and outcomes
CreateGrant returns both values. GrantId identifies the grant with the key when ending it; GrantToken supports using a new grant before propagation. Creation and termination follow eventual consistency. A successful termination call does not guarantee immediate denial; verify mismatched requests and actual permissions after termination.