A company’s engineering team is developing an application that creates AWS Key Management Service (AWS KMS) customer managed key grants for users. Immediately after a grant is created, users must be able to use the KMS key to encrypt a 512-byte payload. During load testing, AccessDeniedException errors occasionally occur on the first attempt to encrypt. What should the security specialist recommend to eliminate these errors?

The correct answer is to pass the grant token returned by CreateGrant to users and instruct them to include it in their Encrypt call. AWS KMS operations, particularly grant propagation, can experience eventual consistency. When a grant is created, it might take a short period for the grant to be fully propagated across all KMS servers. If an encryption request is made immediately after grant creation, before propagation is complete, an AccessDeniedException can occur. Including the grant token in the Encrypt call bypasses this propagation delay by directly providing the necessary authorization context, ensuring immediate access. Retrying every 2 minutes is a workaround that addresses eventual consistency but is inefficient and introduces unnecessary delays. Obtaining a random grant token from users or specifying a random name for the grant are incorrect approaches; the grant token is a specific value returned by CreateGrant that represents the grant itself, not an arbitrary identifier.