Which action would provide the required functionality?
Pass the key alias to AWS KMS when calling Encrypt and Decrypt API actions.
Use IAM policies to restrict access to Encrypt and Decrypt API actions.
Use kms:EncryptionContext as a condition when defining IAM policies for the CMK.
Use key policies to restrict access to the appropriate IAM groups.
Explanations:
Passing the key alias to AWS KMS does not control access to data or prevent tampering. The alias is used to reference a key but does not address controlling access to the ciphertext or utilizing AAD.
IAM policies can control access to KMS actions, but they do not directly address the use of additional authenticated data (AAD) or prevent tampering with ciphertext.
Usingkms:EncryptionContextin IAM policies allows control over the context in which a CMK is used. It ensures that only operations with the specified context are allowed, effectively using AAD to protect the ciphertext from tampering.
Key policies restrict access to the CMK but do not utilize AAD to protect ciphertext. While key policies are important for access control, they do not directly address preventing tampering with the ciphertext.
In my opinion, the answer is:
Use kms:EncryptionContext as a condition when defining IAM policies for the CMK.