View a markdown version of this page

AWS KMS permissions - AWS Key Management Service

AWS KMS permissions

This table is designed to help you understand AWS KMS permissions so you can control access to your AWS KMS resources. Definitions of the column headings appear below the table.

You can also learn about AWS KMS permissions in the Actions, resources, and condition keys for AWS Key Management Service topic of the Service Authorization Reference. However, that topic doesn't list all of the condition keys that you can use to refine each permission.

For more information on which AWS KMS operations are valid for symmetric encryption KMS keys, asymmetric KMS keys, and HMAC KMS keys, see the Key type reference.

Note

You might have to scroll horizontally or vertically to see all of the data in the table.

Actions and permissions Policy type Cross-account use Resources (for IAM policies) AWS KMS condition keys

CancelKeyDeletion

kms:CancelKeyDeletion

Key policy

No

KMS key

Conditions for KMS key operations:

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ResourceAliases

aws:ResourceTag/tag-key (AWS global condition key)

kms:ViaService

ConnectCustomKeyStore

kms:ConnectCustomKeyStore

IAM policy No

*

kms:CallerAccount

CreateAlias

kms:CreateAlias

To use this operation, the caller needs kms:CreateAlias permission on two resources:

  • The alias (in an IAM policy)

  • The KMS key (in a key policy)

For details, see Controlling access to aliases.

IAM policy (for the alias)

No

Alias

None (when controlling access to the alias)

Key policy (for the KMS key)

No

KMS key

Conditions for KMS key operations:

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ResourceAliases

aws:ResourceTag/tag-key (AWS global condition key)

kms:ViaService

CreateCustomKeyStore

kms:CreateCustomKeyStore

IAM policy No

*

kms:CallerAccount

CreateGrant

kms:CreateGrant

Key policy

Yes

KMS key

Encryption context conditions:

kms:EncryptionContext:context-key

kms:EncryptionContextKeys

Grant conditions:

kms:GrantConstraintSourceArn

kms:GrantConstraintType

kms:GranteePrincipal

kms:GranteeServicePrincipal

kms:GrantIsForAWSResource

kms:GrantOperations

kms:RetiringPrincipal

kms:RetiringServicePrincipal

Conditions for KMS key operations:

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ResourceAliases

aws:ResourceTag/tag-key (AWS global condition key)

kms:ViaService

CreateKey

kms:CreateKey

IAM policy

No

*

kms:BypassPolicyLockoutSafetyCheck

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ViaService

aws:RequestTag/tag-key (AWS global condition key)

aws:ResourceTag/tag-key (AWS global condition key)

aws:TagKeys (AWS global condition key)

Decrypt

kms:Decrypt

Key policy

Yes

KMS key

Conditions for cryptographic operations

kms:EncryptionAlgorithm

kms:RequestAlias

Encryption context conditions:

kms:EncryptionContext:context-key

kms:EncryptionContextKeys

Conditions for KMS key operations:

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ResourceAliases

aws:ResourceTag/tag-key (AWS global condition key)

kms:ViaService

DeleteAlias

kms:DeleteAlias

To use this operation, the caller needs kms:DeleteAlias permission on two resources:

  • The alias (in an IAM policy)

  • The KMS key (in a key policy)

For details, see Controlling access to aliases.

IAM policy (for the alias)

No

Alias

None (when controlling access to the alias)

Key policy (for the KMS key)

No

KMS key

Conditions for KMS key operations:

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ResourceAliases

aws:ResourceTag/tag-key (AWS global condition key)

kms:ViaService

DeleteCustomKeyStore

kms:DeleteCustomKeyStore

IAM policy No

*

kms:CallerAccount

DeleteImportedKeyMaterial

kms:DeleteImportedKeyMaterial

Key policy

No

KMS key

Conditions for KMS key operations:

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ResourceAliases

aws:ResourceTag/tag-key (AWS global condition key)

kms:ViaService

DeriveSharedSecret

kms:DeriveSharedSecret

Key policy Yes KMS key

Conditions for KMS key operations:

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ResourceAliases

aws:ResourceTag/tag-key (AWS global condition key)

kms:ViaService

Conditions for cryptographic operations:

kms:KeyAgreementAlgorithm

DescribeCustomKeyStores

kms:DescribeCustomKeyStores

IAM policy No

*

kms:CallerAccount

DescribeKey

kms:DescribeKey

Key policy

Yes

KMS key

Conditions for KMS key operations:

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ResourceAliases

aws:ResourceTag/tag-key (AWS global condition key)

kms:ViaService

Other conditions:

kms:RequestAlias

DisableKey

kms:DisableKey

Key policy

No

KMS key

Conditions for KMS key operations:

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ResourceAliases

aws:ResourceTag/tag-key (AWS global condition key)

kms:ViaService

Key last usage condition:

kms:TrailingDaysWithoutKeyUsage

DisableKeyRotation

kms:DisableKeyRotation

Key policy

No

KMS key

Conditions for KMS key operations:

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ResourceAliases

aws:ResourceTag/tag-key (AWS global condition key)

kms:ViaService

DisconnectCustomKeyStore

kms:DisconnectCustomKeyStore

IAM policy No

*

kms:CallerAccount

EnableKey

kms:EnableKey

Key policy

No

KMS key

Conditions for KMS key operations:

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ResourceAliases

aws:ResourceTag/tag-key (AWS global condition key)

kms:ViaService

EnableKeyRotation

kms:EnableKeyRotation

Key policy

No

KMS key

Conditions for KMS key operations:

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ResourceAliases

aws:ResourceTag/tag-key (AWS global condition key)

kms:ViaService

Automatic key rotation conditions:

kms:RotationPeriodInDays

Encrypt

kms:Encrypt

Key policy

Yes

KMS key

Conditions for cryptographic operations

kms:EncryptionAlgorithm

kms:RequestAlias

Encryption context conditions:

kms:EncryptionContext:context-key

kms:EncryptionContextKeys

Conditions for KMS key operations:

kms:CallerAccount

kms:KeySpec

kms:KeyUsage

kms:KeyOrigin

kms:MultiRegion

kms:MultiRegionKeyType

kms:ResourceAliases

aws:ResourceTag/tag-key (AWS global condition key)

kms:ViaService

GenerateDataKey

kms:GenerateDataKey

Key policy

Yes