AWS KMS is stricter than Amazon S3 for cross-account access. The caller's identity-based policy must allow kms:Decrypt, AND the target key's key policy in the key's own account must also allow the caller. Neither side alone is sufficient; this is the double-grant model unique to AWS KMS. Option A adds the missing key-policy statement that names the Lambda execution role ARN as Principal and allows kms:Decrypt. This is the trap flagged as Trap 9 in the DVA-C02 study notes.

白話文解釋

A safety deposit box inside another bank requires two keys. Your own bank manager hands you a permission slip, but the other bank's branch manager must also write your name on an approved-visitor list taped to the vault door. Without both the permission slip and the list entry, the vault does not open. AWS KMS cross-account is that two-key vault.

選項分析

A：Correct because AWS KMS always requires the key policy to grant access; the identity-based policy alone cannot cross the account boundary for KMS.
B：Wrong because removing the identity-based policy drops the caller-side allow and the call would still be denied on that side.
C：Wrong because the kms:Decrypt authorization check always evaluates the key policy; the network path is irrelevant.
D：Wrong because importing key material across accounts is not a supported workflow and still requires a key policy to allow decrypt.