Question

What is the effect of the following AWS Key Management Service (AWS KMS} key policy that is attached to a customer managed key?

Accepted Answer

C. The customer managed key can be used for encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region.

Answer

Amazon WorkMail and Amazon Simple Email Service (Amazon SES) have delegated KMS encrypt and decrypt permissions to the ExampleRole principal in the 111122223333 account.

Answer

The ExampleRole principal can transparently encrypt and decrypt email exchanges specifically between ExampleRole and AWS.

Answer

The key policy allows Amazon WorkMail or Amazon Simple Email Service (Amazon SES) to encrypt or decrypt on behalf of the ExampleRole for any customer managed key in the account.