A production account uses an AWS KMS customer managed key to encrypt Amazon EBS volumes. A separate analytics account must be able to create encrypted snapshots and volumes using that same key, but the security team requires that the key itself never leaves the production account. Which configuration grants the analytics account use of the key while keeping the key in the production account?
- AExport the key material from the production account and import it into a new customer managed key created in the analytics account so both accounts hold the same key.
- BMake the customer managed key public by adding a key policy statement that allows any principal to call it, so the analytics account can use it without further setup.
- CSwitch the volumes to an AWS managed key for EBS, because AWS managed keys are automatically shared with every account in the organisation for encryption.
- DUpdate the key policy in the production account to allow the analytics account principal to use the key, and grant matching KMS permissions to roles in the analytics account. Correct
Why A is wrong: KMS does not allow exporting key material from a key it generated, and copying a key into another account would violate the requirement that the key never leaves the production account.
Why B is wrong: Allowing any principal exposes the key far beyond the analytics account and breaks least privilege, so it is an insecure way to grant the cross-account access the scenario needs.
Why C is wrong: AWS managed keys cannot have their policy edited for cross-account use and are scoped to a single account and service, so they do not enable another account to use them.
Why D is correct: Cross-account key use requires the key policy to permit the other account plus IAM permissions on the consuming side, which lets analytics roles call the key while the key stays in the production account.