Your developer is using the KMS service and an assigned key in their Java program. They get the below error when running the code.
 arn:aws:iam::113745388712:user/UserB is not authorized to perform: kms:DescribeKey
Which of the following options could help resolve the issue? [Select TWO]

Answer options:

A.Ensure that UserB is given the right IAM role to access the key.
B.Ensure that UserB is given the right permissions in the IAM policy.
C.Ensure that UserB is given the right permissions in the Key policy.
D.Ensure that UserB is given the right permissions in the Bucket policy.

Answer: B and C
Option A is incorrect because you do not need to assign roles to allow access to the application.
Options B is CORRECT because the authentication and access control of KMS API operations can be done using IAM Policies.
Option C is CORRECT because the authentication and access control of KMS API operations can be done using Key Policies.
Option D is incorrect because the permissions are not pertinent to the bucket policy.
In our scenario, we are receiving an error indicating that UserB has not been authorized to perform the "DescribeKey" action. It is because that this permission is not defined in the Key or IAM Policy. 
For more information on IAM & Key Policy, kindly refer to the below URLs:
https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html
https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html