Security Engineering

ran into something weird today. i have an iam role with kms:decrypt on a specific key but it keeps failing with access denied unless i add kms:describekey too. is this a hidden dependency or am i just missing something basic about how kms interacts with the calling identity?

everyone keeps whining about mfa fatigue like it's some inevitable force of nature. if your users are hitting accept on random push notifications, your ux is the problem, not the security model. stop trying to patch human behavior with more auth factors and just use hardware keys…