Changing a key policy - AWS Key Management Service

Changing a key policy

You can change the key policy for a KMS key in your AWS account by using the AWS Management Console or the PutKeyPolicy operation. You cannot use these techniques to change the key policy of a KMS key in a different AWS account.

When changing a key policy, keep in mind the following rules:

  • You can view the key policy for an AWS managed key or a customer managed key, but you can only change the key policy for a customer managed key. The policies of AWS managed keys are created and managed by the AWS service that created the KMS key in your account. You cannot view or change the key policy for an AWS owned key.

  • You can add or remove IAM users, IAM roles, and AWS accounts in the key policy, and change the actions that are allowed or denied for those principals. For more information about the ways to specify principals and permissions in a key policy, see Key policies.

  • You cannot add IAM groups to a key policy, but you can add multiple IAM users and IAM roles. For more information, see Allowing multiple IAM principals to access a KMS key.

  • If you add external AWS accounts to a key policy, you must also use IAM policies in the external accounts to give permissions to IAM users, groups, or roles in those accounts. For more information, see Allowing users in other accounts to use a KMS key.

  • The resulting key policy document cannot exceed 32 KB (32,768 bytes).

How to change a key policy

You can change a key policy in three different ways as explained in the following sections.

Using the AWS Management Console default view

You can use the console to change a key policy with a graphical interface called the default view.

If the following steps don't match what you see in the console, it might mean that this key policy was not created by the console. Or it might mean that the key policy has been modified in a way that the console's default view does not support. In that case, follow the steps at Using the AWS Management Console policy view or Using the AWS KMS API.

  1. View the key policy for a customer managed key as described in Viewing a key policy (console). (You cannot change the key policies of AWS managed keys.)

  2. Decide what to change.

    • To add or remove key administrators, and to allow or prevent key administrators from deleting the KMS key, use the controls in the Key administrators section of the page. Key administrators manage the KMS key, including enabling and disabling it, setting key policy, and enabling key rotation.

    • To add or remove key users, and to allow or disallow external AWS accounts to use the KMS key, use the controls in the Key users section of the page. Key users can use the KMS key in cryptographic operations, such as encrypting, decrypting, re-encrypting, and generating data keys.

Using the AWS Management Console policy view

You can use the console to change a key policy document with the console's policy view.

  1. View the key policy for a customer managed key as described in Viewing a key policy (console). (You cannot change the key policies of AWS managed keys.)

  2. In the Key Policy section, choose Switch to policy view.

  3. Edit the key policy document, and then choose Save changes.

Using the AWS KMS API

You can use the PutKeyPolicy operation to change the key policy of a KMS key in your AWS account. You cannot use this API on a KMS key in a different AWS account.

  1. Use the GetKeyPolicy operation to get the existing key policy document, and then save the key policy document to a file. For sample code in multiple programming languages, see Getting a key policy.

  2. Open the key policy document in your preferred text editor, edit the key policy document, and then save the file.

  3. Use the PutKeyPolicy operation to apply the updated key policy document to the KMS key. For sample code in multiple programming languages, see Setting a key policy.

For an example of copying a key policy from one KMS key to another, see the GetKeyPolicy example in the AWS CLI Command Reference.

Allowing multiple IAM principals to access a KMS key

IAM groups are not valid principals in a key policy. To allow multiple users and roles to access a KMS key, do one of the following:

  • Use an IAM role as the principal in the key policy. Multiple authorized users can assume the role as needed. For details, see IAM roles in the IAM User Guide.

    While you can list multiple IAM users in a key policy, this practice is not recommended because it requires that you update the key policy every time the list of authorized users changes. Also, IAM best practices discourage the use of IAM users with long-term credentials. For details, see Security best practices in IAM in the IAM User Guide.

  • Use an IAM policy to give permission to an IAM group. To do this, ensure that the key policy includes the statement that enables IAM policies to allow access to the KMS key, create an IAM policy that allows access to the KMS key, and then attach that policy to an IAM group that contains the authorized IAM users. Using this approach, you don't need to change any policies when the list of authorized users changes. Instead, you only need to add or remove those users from the appropriate IAM group. For details, see IAM user groups in the IAM User Guide

For more information about how AWS KMS key policies and IAM policies work together, see Troubleshooting key access.