A security engineer wants to create a new AWS KMS customer managed key.

Comprehensive and Detailed 100to 150 words of Explanation From AWS Certified Security – Specialty topics:

The key policy must separate key administration from key usage. KMSAdmin needs permissions that allow creation-related and disable-related KMS actions, so kms:Create* and kms:Disable* match the administrative requirement. KMSUser only needs cryptographic usage permission for decryption, so kms:Decrypt is sufficient. AWS KMS documentation explains that all KMS keys require key policies and that key administrators can manage keys while key users can be granted cryptographic operations such as decrypt. Option A is technically weak because kms:Create is not the correct wildcard form for KMS create operations. Option C lacks required decrypt permission. Option D gives no create or disable capability to KMSAdmin.

================