Nordic Bio runs a Lambda function in Account A that must encrypt data using a KMS key in Account B. Due to platform constraints, the Lambda code cannot assume a role in another account. What should the security team do to enable this cross-account encryption without code changes?

The correct approach involves configuring both the resource-based policy (KMS key policy) and the identity-based policy (IAM role policy). The KMS key policy in Account B must explicitly grant the Lambda execution role ARN from Account A permission to perform kms:Encrypt and kms:GenerateDataKey actions on that specific key. Concurrently, the Lambda's execution role in Account A must also have an IAM policy allowing these same KMS actions. This dual configuration ensures that the principal (Lambda role) has the necessary permissions and the resource (KMS key) allows access from that principal. Incorrect options: An interface VPC endpoint for KMS is for private network access to KMS, not for cross-account authorization. A trust relationship is part of an IAM role's policy, defining who can assume the role, not directly granting access to a KMS key. AWS Resource Access Manager (RAM) is used to share certain AWS resources, but KMS keys cannot be shared directly via RAM for cross-account encryption. Access is controlled through key policies.