Which of the following is a possible reason that the IAM user cannot access the objects in the S3 bucket?
The IAM policy needs to allow the kms:DescribeKey permission.
The S3 bucket has been changed to use the AWS managed key to encrypt objects at rest.
An S3 bucket policy needs to be added to allow the IAM user to access the objects.
The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key.
Explanations:
Thekms:DescribeKeypermission is not required for decrypting objects in S3. Thekms:Decryptpermission is sufficient.
The issue is related to KMS permissions, not the encryption method. The KMS key is a customer-managed key in the same account.
The S3 bucket has no bucket policy, but the issue is related to KMS permissions, not S3 bucket policies.
If the KMS key policy has been edited to remove full access for the AWS account, it would prevent the IAM user from decrypting objects.
From my perspective, the answer is:
The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key.
From my point of view, the answer is:
The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key.