medium10 pts · first answer countsencryptioniam
Cross-account KMS decrypt fails
A role in account B has kms:Decrypt in its IAM policy but cannot read S3 objects encrypted with a customer managed key in account A. What is missing?
Discussion 0
Join free to post in the discussion.
Related questions
- Principle of least privilegeCloud Engineer
- Which identity is the AWS CLI using?Cloud Engineer
- Protecting the root userCloud Engineer
- What HTTPS protectsCloud Engineer
- Giving a VM access to cloud APIsCloud Engineer
- Reading an S3 SecureTransport policyCloud Engineer
- AccessDenied from a VPC endpoint policyCloud Engineer
- Overly broad GitHub OIDC trust policyCloud Engineer