An application in Account A needs to retrieve a Secrets Manager secret that is encrypted under a KMS key in Account B. The application's role already has Secrets Manager permissions in Account B. To allow the role in Account A to use the KMS key in Account B with least privilege, which KMS permissions should be added to the key policy?

The application needs kms:Decrypt to decrypt the secret's data, as Secrets Manager encrypts secrets using KMS. It also needs kms:DescribeKey to retrieve information about the KMS key, which is often a prerequisite for decryption operations across accounts or for services to validate key access. These two permissions grant the necessary access with least privilege. secretsmanager:DescribeSecret and secretsmanager:GetSecretValue are Secrets Manager permissions, which the problem states the role already has in Account B. kms: grants overly broad permissions, violating the principle of least privilege. secretsmanager: is incorrect because the issue is with KMS key access, not Secrets Manager permissions.