An IAM user receives Access Denied errors when trying to access objects in an Amazon S3 bucket. The user and the bucket are in the same AWS account. The bucket uses server-side encryption with AWS KMS keys (SSE-KMS) and a customer managed key from the same account. There is no bucket policy. The user’s IAM policy allows kms:Decrypt on the key and s3:List* and s3:Get* on the bucket and objects. What is a possible reason the user cannot access the objects?

The correct answer is that the KMS key policy was modified to remove full access for the AWS account. Even if an IAM policy grants kms:Decrypt permissions, the KMS key policy must also explicitly allow the AWS account (and by extension, the IAM user) to perform actions on the key. If the key policy was modified to restrict access, the user would receive an Access Denied error. The IAM policy does not need to allow kms:DescribeKey for decryption. While useful for auditing, it's not required for accessing encrypted objects. Changing the bucket to use an AWS managed KMS key (SSE-S3 or SSE-KMS with an AWS managed key) would likely resolve the issue if the user had S3 permissions, but the question states a customer managed key is in use. A bucket policy is not strictly necessary when the user and bucket are in the same account and the IAM policy is correctly configured; the IAM policy alone can grant access.