Thanks for letting us know we're doing a good job!
If you've got a moment, please tell us what we did right so we can do more of it.
AWS KMS API permissions: Actions and resources reference
The Actions and Resources Table is designed to help you define access control in key policies and IAM policies. The columns provide the following information:
-
API operations and actions (permissions) lists each AWS KMS API operation and the corresponding action (permission) that allows the operation. You specify actions in a policy's
Actionelement. -
Policy type indicates whether the permission can be used in a key policy or IAM policy. When the type is key policy, you can specify the permission explicitly in the key policy. Or, if the key policy contains the policy statement that enables IAM policies, you can specify the permission in an IAM policy. When the type is IAM policy, you can specify the permission only in an IAM policy.
-
Resources lists the resources for which you can allow the operation. To specify a resource in an IAM policy, type the Amazon Resource Name (ARN) in the
Resourceelement. Because a key policy applies only to the CMK that it is attached to, the value of itsResourceelement is always"*".Each resource type is associated with an ARN that you use to represent the resource.
- CMK ARNs
-
When the resource is a CMK, you represent it by using a CMK ARN.
arn:AWS_partition_name:AWS_Region:AWS_account_ID:key/CMK_key_IDFor example:
arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
- Alias ARNs
-
When the resource is an alias, you represent it by using an alias ARN.
arn:AWS_partition_name:AWS_region:AWS_account_ID:alias/alias_nameFor example:
arn:aws:kms:us-west-2:111122223333:alias/ExampleAlias
-
AWS KMS condition keys lists the AWS KMS condition keys that you can use to control access to the operation. You specify conditions in a policy's
Conditionelement. For more information, see AWS KMS condition keys. This column also includes AWS global condition keys that are supported by AWS KMS, but not by all AWS services.
|
AWS KMS API operations and permissions
|
|||
|---|---|---|---|
| API operations and actions (permissions) | Policy type | Resources (for IAM policies) | AWS KMS condition keys |
|
|
Key policy |
CMK |
|
| ConnectCustomKeyStore
|
IAM policy | * |
kms:CallerAccount |
|
To use this
operation, the caller needs
|
IAM policy (for the alias) |
Alias |
None (when controlling access to the alias) |
|
Key policy (for the CMK) |
CMK |
kms:ViaService |
|
| CreateCustomKeyStore
|
IAM policy | * |
kms:CallerAccount |
|
|
Key policy |
CMK |
|
|
|
IAM policy |
|
|
|
|
Key policy |
CMK |
|
|
To use this
operation, the caller needs
|
IAM policy (for the alias) |
Alias |
None (when controlling access to the alias) |
|
Key policy (for the CMK) |
CMK |
|
|
| DeleteCustomKeyStore
|
IAM policy | * |
kms:CallerAccount |
|
|
Key policy |
CMK |
|
| DescribeCustomKeyStores
|
IAM policy | * |
kms:CallerAccount |
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK |
|
| DisconnectCustomKeyStore
|
IAM policy | * |
kms:CallerAccount |
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK (symmetric only) |
|
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK (symmetric only) |
kms:CallerAccount
kms:EncryptionAlgorithm
|
|
|
Key policy |
CMK (symmetric only) |
kms:CallerAccount
kms:DataKeyPairSpec
|
|
GenerateDataKeyPairWithoutPlaintext
|
Key policy |
CMK (symmetric only) |
kms:CallerAccount
kms:DataKeyPairSpec
|
|
GenerateDataKeyWithoutPlaintext
|
Key policy |
CMK (symmetric only) |
kms:CallerAccount
kms:EncryptionAlgorithm
|
|
|
IAM policy |
|
None |
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK (symmetric only) |
|
|
|
Key policy |
CMK (symmetric only) |
|
|
|
Key policy |
CMK (asymmetric only) |
|
|
|
Key policy |
CMK (symmetric only) |
|
|
|
IAM policy |
|
None |
|
|
Key policy |
CMK |
kms:GrantIsForAWSResource
kms:ViaService
|
|
|
Key policy |
CMK |
|
|
|
IAM policy |
|
None |
|
|
Key policy |
CMK |
|
|
|
IAM policy |
|
None |
|
|
Key policy |
CMK |
|
|
To use this operation, the caller needs permission on two CMKs:
|
Key policy |
CMK |
kms:EncryptionAlgorithm
|
|
Permission to retire a grant is specified in the grant. You cannot control access to this operation in a policy. For more information, see RetireGrant in the AWS Key Management Service API Reference. |
Not applicable |
Not applicable |
Not applicable |
|
|
Key policy |
CMK |
kms:CallerAccount
|
|
|
Key policy |
CMK |
kms:ViaService
|
|
|
Key policy |
CMK (asymmetric only) |
kms:CallerAccount
kms:MessageType
|
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK |
|
|
To use this
operation, the caller needs
|
IAM policy (for the alias) |
Alias |
None (when controlling access to the alias) |
|
Key policy (for the CMKs) |
CMK |
|
|
| UpdateCustomKeyStore
|
IAM policy | * |
kms:CallerAccount |
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK (asymmetric only) |
|
