A DevOps team manages permissions with AWS Identity and Access Management (IAM). An EC2 instance profile role with the AWS managed ReadOnlyAccess policy is attached to an application running on Amazon EC2. When the application tries to read an object from an Amazon S3 bucket that is encrypted with a KMS key, it receives an AccessDenied error. The S3 bucket policy allows access for everyone in the account, and the object has no ACL. What should the administrator do to resolve the IAM access issue?

The correct answer is to attach an inline policy to the IAM role that grants kms:Decrypt permissions. The ReadOnlyAccess policy provides read-only access to AWS services, but it does not include permissions for AWS Key Management Service (KMS) operations. When an S3 object is encrypted with a KMS key, the principal attempting to access it must have explicit kms:Decrypt permissions in addition to S3 read permissions. Attaching an inline policy directly to the EC2 instance's IAM role is the most direct way to grant these specific permissions without altering broader managed policies. Modifying the ReadOnlyAccess managed policy is not recommended because managed policies are maintained by AWS and should generally not be altered. Adding the EC2 IAM role as a Principal in the S3 bucket policy would grant S3 access but would not resolve the missing kms:Decrypt permission. Attaching an inline policy with S3: permissions is overly permissive and violates the principle of least privilege, as the application only needs read access to S3 and specific KMS decryption permissions.