Note that if a caller has been granted access permissions to all keys (through, for example, IAM user policies that grant Decrypt
permission on all resources), then ciphertext encrypted by using keys in other accounts where the key grants access to the caller can be decrypted. To remedy this, we recommend that you do not grant Decrypt
access in an IAM user policy. Instead grant Decrypt
access only in key policies. If you must grant Decrypt
access in an IAM user policy, you should scope the resource to specific keys or to specific trusted accounts.