AWS KMS root permissions

[Oscar_Alvarez]

One customer is considering using AWS KMS and has reservations over giving Genesys' AWS account root permissions into their own AWS environment as per Use an AWS KMS symmetric key for recordings - Genesys Cloud Resource Center (mypurecloud.com)

“Principal”: {
“AWS”: [
“arn:aws:iam::765628985471:root”
]
}

Is it possible to use another role, and if not is Genesys able to provide some information that could ease the customer's concerns?

I raised a case in the Support portal but they are referring to the dev team, so I thought I might get a quicker response here. A similar question was asked previously but the topic was closed before Genesys provided a response:

AWS Integration root alarm

Hi All, I have a customer who is using a cloud monitoring tools (DivvyCloud) to assist them with security, and the Genesys integration is throwing a security alert because the account trust is for root: "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::765628985471:root" }, It's basically against their security policy to have an IAM role that references a root level permission, so it's throwing a severe / out of compliance error. Wondering if there's a remedy for this and/or i…

Thanks,
Oscar