A development team is building a supply chain application that stores sensitive inventory data in an Amazon S3 bucket. The data will be encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The data must be shared with hundreds of vendors, each using principals from their own AWS accounts. The vendor list will change weekly. The solution must support cross-account access with minimal operational overhead. What is the most efficient way to manage key access control?

KMS grants are the most efficient way to manage key access for a frequently changing list of external principals. Grants provide fine-grained, programmatic control over KMS key permissions, allowing specific operations for specific principals. Creating and revoking grants for hundreds of vendors weekly is much simpler and more scalable than modifying a single, potentially large, IAM role or KMS key policy. IAM roles and KMS key policies become complex and difficult to manage with a large, dynamic set of principals, as they require direct modification of the policy document itself. Delegated cross-account access with IAM roles would still require managing individual role trust policies, which is less efficient than grants for this use case.