AWS SDK Version 3 for .NET
API Reference

AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.

Container for the parameters to the PutKeyPolicy operation. Attaches a key policy to the specified customer master key (CMK).

For more information about key policies, see Key Policies in the AWS Key Management Service Developer Guide.

Inheritance Hierarchy

System.Object
  Amazon.Runtime.AmazonWebServiceRequest
    Amazon.KeyManagementService.AmazonKeyManagementServiceRequest
      Amazon.KeyManagementService.Model.PutKeyPolicyRequest

Namespace: Amazon.KeyManagementService.Model
Assembly: AWSSDK.KeyManagementService.dll
Version: 3.x.y.z

Syntax

C#
public class PutKeyPolicyRequest : AmazonKeyManagementServiceRequest
         IAmazonWebServiceRequest

The PutKeyPolicyRequest type exposes the following members

Constructors

NameDescription
Public Method PutKeyPolicyRequest()

Properties

NameTypeDescription
Public Property BypassPolicyLockoutSafetyCheck System.Boolean

Gets and sets the property BypassPolicyLockoutSafetyCheck.

A flag to indicate whether to bypass the key policy lockout safety check.

Setting this value to true increases the likelihood that the CMK becomes unmanageable. Do not set this value to true indiscriminately.

For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide.

Use this parameter only when you intend to prevent the principal that is making the request from making a subsequent PutKeyPolicy request on the CMK.

The default value is false.

Public Property KeyId System.String

Gets and sets the property KeyId.

A unique identifier for the CMK.

Use the CMK's unique identifier or its Amazon Resource Name (ARN). For example:

  • Unique ID: 1234abcd-12ab-34cd-56ef-1234567890ab

  • ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

Public Property Policy System.String

Gets and sets the property Policy.

The key policy to attach to the CMK.

If you do not set BypassPolicyLockoutSafetyCheck to true, the policy must meet the following criteria:

  • It must allow the principal that is making the PutKeyPolicy request to make a subsequent PutKeyPolicy request on the CMK. This reduces the likelihood that the CMK becomes unmanageable. For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide.

  • The principals that are specified in the key policy must exist and be visible to AWS KMS. When you create a new AWS principal (for example, an IAM user or role), you might need to enforce a delay before specifying the new principal in a key policy because the new principal might not immediately be visible to AWS KMS. For more information, see Changes that I make are not always immediately visible in the IAM User Guide.

The policy size limit is 32 KiB (32768 bytes).

Public Property PolicyName System.String

Gets and sets the property PolicyName.

The name of the key policy.

This value must be default.

Examples

The following example attaches a key policy to the specified CMK.

To attach a key policy to a customer master key (CMK)


            var response = client.PutKeyPolicy(new PutKeyPolicyRequest 
            {
                KeyId = "1234abcd-12ab-34cd-56ef-1234567890ab", // The identifier of the CMK to attach the key policy to. You can use the key ID or the Amazon Resource Name (ARN) of the CMK.
                Policy = "{
    \"Version\": \"2012-10-17\",
    \"Id\": \"custom-policy-2016-12-07\",
    \"Statement\": [
        {
            \"Sid\": \"Enable IAM User Permissions\",
            \"Effect\": \"Allow\",
            \"Principal\": {
                \"AWS\": \"arn:aws:iam::111122223333:root\"
            },
            \"Action\": \"kms:*\",
            \"Resource\": \"*\"
        },
        {
            \"Sid\": \"Allow access for Key Administrators\",
            \"Effect\": \"Allow\",
            \"Principal\": {
                \"AWS\": [
                    \"arn:aws:iam::111122223333:user/ExampleAdminUser\",
                    \"arn:aws:iam::111122223333:role/ExampleAdminRole\"
                ]
            },
            \"Action\": [
                \"kms:Create*\",
                \"kms:Describe*\",
                \"kms:Enable*\",
                \"kms:List*\",
                \"kms:Put*\",
                \"kms:Update*\",
                \"kms:Revoke*\",
                \"kms:Disable*\",
                \"kms:Get*\",
                \"kms:Delete*\",
                \"kms:ScheduleKeyDeletion\",
                \"kms:CancelKeyDeletion\"
            ],
            \"Resource\": \"*\"
        },
        {
            \"Sid\": \"Allow use of the key\",
            \"Effect\": \"Allow\",
            \"Principal\": {
                \"AWS\": \"arn:aws:iam::111122223333:role/ExamplePowerUserRole\"
            },
            \"Action\": [
                \"kms:Encrypt\",
                \"kms:Decrypt\",
                \"kms:ReEncrypt*\",
                \"kms:GenerateDataKey*\",
                \"kms:DescribeKey\"
            ],
            \"Resource\": \"*\"
        },
        {
            \"Sid\": \"Allow attachment of persistent resources\",
            \"Effect\": \"Allow\",
            \"Principal\": {
                \"AWS\": \"arn:aws:iam::111122223333:role/ExamplePowerUserRole\"
            },
            \"Action\": [
                \"kms:CreateGrant\",
                \"kms:ListGrants\",
                \"kms:RevokeGrant\"
            ],
            \"Resource\": \"*\",
            \"Condition\": {
                \"Bool\": {
                    \"kms:GrantIsForAWSResource\": \"true\"
                }
            }
        }
    ]
}
", // The key policy document.
                PolicyName = "default" // The name of the key policy.
            });


            

Version Information

.NET Standard:
Supported in: 1.3

.NET Framework:
Supported in: 4.5, 4.0, 3.5

Portable Class Library:
Supported in: Windows Store Apps
Supported in: Windows Phone 8.1
Supported in: Xamarin Android
Supported in: Xamarin iOS (Unified)
Supported in: Xamarin.Forms