Skip to content

Instantly share code, notes, and snippets.

@dagrz
Last active May 31, 2016 13:13
Show Gist options
  • Save dagrz/7b8061dee02e33629a4a301f46049d10 to your computer and use it in GitHub Desktop.
Save dagrz/7b8061dee02e33629a4a301f46049d10 to your computer and use it in GitHub Desktop.
{
"Version": "2012-10-17",
"Id": "Key policy created for CloudTrail",
"Statement": [
{
"Sid": "Enable IAM User Permissions",
"Effect": "Allow",
"Principal": {
"AWS": "[account-id]/[user-id]"
},
"Action": [
"kms:DisableKey",
"kms:ScheduleKeyDeletion",
"kms:GenerateDataKey*",
"kms:DescribeKey"
],
"Resource": "*"
},
{
"Sid": "Allow CloudTrail to encrypt logs",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "kms:GenerateDataKey*",
"Resource": "*",
"Condition": {
"StringLike": {
"kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:[account-id]:trail/*"
}
}
},
{
"Sid": "Allow CloudTrail to describe key",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "kms:DescribeKey",
"Resource": "*"
}
]
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment