Account A's KMS key encrypts S3 objects that account B must read. Both permissions exist — the key policy lists account B, and B's role allows kms:Decrypt — yet access still fails. What's missing?
A.Account B needs its own KMS key for the bucket
A second key doesn't help — objects are encrypted with A's key.
B.The S3 bucket policy must also grant account B s3:GetObject — KMS access alone doesn't grant S3 access
Correct. KMS grants and S3 grants are independent authorization layers.
C.Enable automatic key rotation
Rotation doesn't affect cross-account permissioning.
D.Nothing — cross-account KMS is impossible
Cross-account KMS access is fully supported — it just needs both layers.
Why this answer
Cross-account encrypted S3 access requires THREE layers: KMS key policy allowing the external principal, IAM policy in B allowing kms:Decrypt, AND bucket/object permissions granting S3 access. The question shows only the KMS layer — S3 authorization is still missing.
Correct answer: B · Last reviewed 2026-11-01
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Protection & Encryption practice session.
Practice Data Protection & Encryption