Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 225 discussion

D. The AWS KMS API follows an eventual consistency model. When you create a grant, the grant might not be effective immediately. To use the permissions in a new grant immediately, use the grant token for the grant. https://docs.aws.amazon.com/kms/latest/developerguide/using-grant-token.html

Grant Token Usage: When a grant is created, AWS KMS returns a grant token. This token can be used immediately to perform cryptographic operations with the KMS key, even before the grant is fully propagated. Immediate Access: By passing the grant token to the users and instructing them to use it in their encryption calls, you ensure that they can immediately use the KMS key without encountering access issues. This approach addresses the timing issue that causes the AccessDeniedException errors by allowing immediate use of the grant.

The best solution to eliminate the AccessDeniedException errors is D. Instruct the engineering team to pass the grant token returned in the CreateGrant response to users. Instruct users to use that grant token in their call to encrypt.

Option A acknowledges the propagation delay but relies on a suboptimal workaround (retries) instead of using the solution designed for this exact issue (grant tokens). Therefore, D is the correct answer as it resolves the problem efficiently and aligns with AWS best practices.

A because of propagation delays