A central security account owns a customer managed "AWS Key Management Service" key used to encrypt shared application data. Workloads running in several other accounts in the same organisation must be able to decrypt that data using the key, but the security account must retain full administrative control of the key and be able to revoke a single account's access without recreating the key. Which approach BEST grants cross-account decrypt access while keeping control central?
- AExport the key material from the security account and import the same material into a customer managed key in each consuming account so they can decrypt locally.
- BGrant decrypt access in the KMS key policy to each consuming account and have those accounts delegate the permission with "AWS Identity and Access Management" policies, revoking one by removing it from the key policy. Correct
- CMake the key an "AWS" managed key in the security account and add the consuming account numbers to its automatically generated key policy so they inherit decrypt rights.
- DCreate a "KMS" key alias in each consuming account that points at the security account key so the workloads resolve the alias locally and decrypt the shared data.
Why A is wrong: Exporting and importing material into separate keys removes central control entirely and means revoking one account requires touching every copy, the opposite of the centralised, individually revocable access the requirement demands.
Why B is correct: Cross-account KMS access requires the key policy in the owning account to allow the external account, after which each account grants its own principals via IAM; the security account keeps administration and can revoke a single account by removing its statement from the key policy without recreating the key.
Why C is wrong: AWS managed keys cannot have their key policy edited to grant cross-account access and cannot be shared this way, so this option misuses the key type and cannot satisfy the cross-account decrypt need.
Why D is wrong: A KMS alias is only a local friendly name within one account and cannot reference a key in another account, so it grants no permission and does not provide cross-account access at all.