AWS KMS API permissions: Actions and resources reference
The Actions and Resources Table is designed to help you define access control in key policies and IAM policies. The columns provide the following information:
-
API operations and actions (permissions) lists each AWS KMS API operation and the corresponding action (permission) that allows the operation. You specify actions in a policy's
Actionelement. -
Policy type indicates whether the permission can be used in a key policy or IAM policy. When the type is key policy, you can specify the permission explicitly in the key policy. Or, if the key policy contains the policy statement that enables IAM policies, you can specify the permission in an IAM policy. When the type is IAM policy, you can specify the permission only in an IAM policy.
-
Resources lists the AWS KMS resources to which the permissions apply. AWS KMS supports two resource types: a customer master key (CMK) and an alias. In a key policy, the value of the
Resourceelement is always*, which indicates the CMK to which the key policy is attached.Use the following values to represent an AWS KMS resource in an IAM policy.
- CMK
-
When the resource is a customer master key (CMK), use its key ARN. For help, see Finding the key ID and ARN.
arn:AWS_partition_name:kms:AWS_Region:AWS_account_ID:key/key_IDFor example:
arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab
- Alias
-
When the resource is an alias, use its alias ARN. To get the alias ARN, use the ListAliases operation.
arn:AWS_partition_name:kms:AWS_region:AWS_account_ID:alias/alias_nameFor example:
arn:aws:kms:us-west-2:111122223333:alias/ExampleAlias
*(asterisk)-
When the permission doesn't apply to a particular resource (CMK or alias), use an asterisk (
*).In an IAM policy for an AWS KMS permission, an asterisk in the
Resourceelement indicates all AWS KMS resources (CMKs and aliases). You can also use an asterisk in theResourceelement when the AWS KMS permission doesn't apply to any particular CMKs or aliases. For example, when allowing or denyingkms:CreateKeyorkms:ListKeyspermission, you can set theResourceelement to*or to an account-specific variation, such asarn:.AWS_partition_name:kms:AWS_region:AWS_account_ID:*
-
AWS KMS condition keys lists the AWS KMS condition keys that you can use to control access to the operation. You specify conditions in a policy's
Conditionelement. For more information, see AWS KMS condition keys. This column also includes AWS global condition keys that are supported by AWS KMS, but not by all AWS services.
|
AWS KMS API operations and permissions
|
|||
|---|---|---|---|
| API operations and actions (permissions) | Policy type | Resources (for IAM policies) | AWS KMS condition keys |
|
|
Key policy |
CMK |
|
| ConnectCustomKeyStore
|
IAM policy |
|
kms:CallerAccount |
|
To use this
operation, the caller needs
For details, see Controlling access to aliases. |
IAM policy (for the alias) |
Alias |
None (when controlling access to the alias) |
|
Key policy (for the CMK) |
CMK |
kms:ViaService |
|
| CreateCustomKeyStore
|
IAM policy |
|
kms:CallerAccount |
|
|
Key policy |
CMK |
|
|
|
IAM policy |
|
|
|
|
Key policy |
CMK |
|
|
To use this
operation, the caller needs
For details, see Controlling access to aliases. |
IAM policy (for the alias) |
Alias |
None (when controlling access to the alias) |
|
Key policy (for the CMK) |
CMK |
|
|
| DeleteCustomKeyStore
|
IAM policy |
|
kms:CallerAccount |
|
|
Key policy |
CMK |
|
| DescribeCustomKeyStores
|
IAM policy |
|
kms:CallerAccount |
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK |
|
| DisconnectCustomKeyStore
|
IAM policy |
|
|
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK (symmetric only) |
|
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK (symmetric only) |
kms:CallerAccount
kms:EncryptionAlgorithm
|
|
|
Key policy |
CMK (symmetric only)
|
kms:CallerAccount
kms:DataKeyPairSpec
|
|
GenerateDataKeyPairWithoutPlaintext
|
Key policy |
CMK (symmetric only)
|
kms:CallerAccount
kms:DataKeyPairSpec
|
|
GenerateDataKeyWithoutPlaintext
|
Key policy |
CMK (symmetric only) |
kms:CallerAccount
kms:EncryptionAlgorithm
|
|
|
IAM policy |
|
None |
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK (symmetric only) |
|
|
|
Key policy |
CMK (symmetric only) |
|
|
|
Key policy |
CMK (asymmetric only) |
|
|
|
Key policy |
CMK (symmetric only) |
|
|
|
IAM policy |
|
None |
|
|
Key policy |
CMK |
kms:GrantIsForAWSResource
kms:ViaService
|
|
|
Key policy |
CMK |
|
|
|
IAM policy |
|
None |
|
|
Key policy |
CMK |
|
|
|
IAM policy |
|
None |
|
|
Key policy |
CMK |
|
|
To use this operation, the caller needs permission on two CMKs:
|
Key policy |
CMK |
kms:EncryptionAlgorithm
|
|
Permission to retire a grant is specified in the grant. You cannot control access to this operation in a policy. For more information, see RetireGrant in the AWS Key Management Service API Reference. |
Not applicable |
Not applicable |
Not applicable |
|
|
Key policy |
CMK |
kms:CallerAccount
|
|
|
Key policy |
CMK |
kms:ViaService
|
|
|
Key policy |
CMK (asymmetric only) |
kms:CallerAccount
kms:MessageType
|
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK |
|
|
To use this
operation, the caller needs
For details, see Controlling access to aliases. |
IAM policy (for the alias) |
Alias |
None (when controlling access to the alias) |
|
Key policy (for the CMKs) |
CMK |
|
|
| UpdateCustomKeyStore
|
IAM policy |
|
kms:CallerAccount |
|
|
Key policy |
CMK |
|
|
|
Key policy |
CMK (asymmetric only) |
|
