It is better using sign and verify instead of encrypt and decrypt.
The difference is here: https://stackoverflow.com/questions/454048/what-is-the-difference-between-encrypting-and-signing-in-asymmetric-encryption.
In AWS, users are limited to access KMS by IAM role. So, This implementation is not so bad Immediately.
But If AWS account owner mistake to managing IAM role and allow that unintentional user can access public key, JWT become tamperable.
It is better using
signandverifyinstead ofencryptanddecrypt.The difference is here: https://stackoverflow.com/questions/454048/what-is-the-difference-between-encrypting-and-signing-in-asymmetric-encryption.
In AWS, users are limited to access KMS by IAM role. So, This implementation is not so bad Immediately.
But If AWS account owner mistake to managing IAM role and allow that unintentional user can access public key, JWT become tamperable.