KMS Resource Policy Examples

default-cmk.key-policy.json

{
  "Version": "2012-10-17",
  "Id": "DefaultKeyPolicy",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::12345678910:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    }
  ]
}

least-privilege.key-policy.json

{
  "Version": "2012-10-17",
  "Id": "LeastPrivilegeKeyPolicy",
  "Statement": [
    {
      "Sid": "AllowRestrictedAdministerResource",
      "Effect": "Allow",
      "Action": [
        "kms:UpdateCustomKeyStore",
        "kms:UntagResource",
        "kms:TagResource",
        "kms:ScheduleKeyDeletion",
        "kms:RevokeGrant",
        "kms:RetireGrant",
        "kms:PutKeyPolicy",
        "kms:GetKeyRotationStatus",
        "kms:GetKeyPolicy",
        "kms:EnableKeyRotation",
        "kms:EnableKey",
        "kms:DisconnectCustomKeyStore",
        "kms:DisableKeyRotation",
        "kms:DisableKey",
        "kms:DeleteAlias",
        "kms:CreateKey",
        "kms:CreateGrant",
        "kms:CreateCustomKeyStore",
        "kms:CreateAlias",
        "kms:ConnectCustomKeyStore",
        "kms:CancelKeyDeletion"
      ],
      "Resource": "*",
      "Principal": {
        "AWS": "*"
      },
      "Condition": {
        "ArnEquals": {
          "aws:PrincipalArn": [
            "arn:aws:iam::12345678910:user/person1",
            "arn:aws:iam::12345678910:user/ci"
          ]
        }
      }
    },
    {
      "Sid": "AllowRestrictedReadData",
      "Effect": "Allow",
      "Action": [
        "kms:Verify",
        "kms:ListRetirableGrants",
        "kms:ListResourceTags",
        "kms:ListKeys",
        "kms:ListKeyPolicies",
        "kms:ListGrants",
        "kms:ListAliases",
        "kms:GetPublicKey",
        "kms:GetParametersForImport",
        "kms:GetKeyRotationStatus",
        "kms:GetKeyPolicy",
        "kms:DescribeKey",
        "kms:DescribeCustomKeyStores",
        "kms:Decrypt"
      ],
      "Resource": "*",
      "Principal": {
        "AWS": "*"
      },
      "Condition": {
        "ArnEquals": {
          "aws:PrincipalArn": [
            "arn:aws:iam::12345678910:user/person1",
            "arn:aws:iam::12345678910:role/appA"
          ]
        }
      }
    },
    {
      "Sid": "AllowRestrictedWriteData",
      "Effect": "Allow",
      "Action": [
        "kms:UpdateKeyDescription",
        "kms:UpdateAlias",
        "kms:Sign",
        "kms:ReEncryptTo",
        "kms:ReEncryptFrom",
        "kms:ImportKeyMaterial",
        "kms:GenerateRandom",
        "kms:GenerateDataKeyWithoutPlaintext",
        "kms:GenerateDataKeyPairWithoutPlaintext",
        "kms:GenerateDataKeyPair",
        "kms:GenerateDataKey",
        "kms:Encrypt"
      ],
      "Resource": "*",
      "Principal": {
        "AWS": "*"
      },
      "Condition": {
        "ArnEquals": {
          "aws:PrincipalArn": [
            "arn:aws:iam::12345678910:user/person1",
            "arn:aws:iam::12345678910:role/appA"
          ]
        }
      }
    },
    {
      "Sid": "AllowRestrictedDeleteData",
      "Effect": "Allow",
      "Action": [
        "kms:DeleteImportedKeyMaterial",
        "kms:DeleteCustomKeyStore"
      ],
      "Resource": "*",
      "Principal": {
        "AWS": "*"
      },
      "Condition": {
        "ArnEquals": {
          "aws:PrincipalArn": []
        }
      }
    },
    {
      "Sid": "AllowRestrictedCustomActions",
      "Effect": "Allow",
      "Action": "kms:DescribeKey",
      "Resource": "*",
      "Principal": {
        "AWS": "*"
      },
      "Condition": {
        "ArnEquals": {
          "aws:PrincipalArn": []
        }
      }
    },
    {
      "Sid": "DenyEveryoneElse",
      "Effect": "Deny",
      "Action": "kms:*",
      "Resource": "*",
      "Principal": {
        "AWS": "*"
      },
      "Condition": {
        "ArnNotEquals": {
          "aws:PrincipalArn": [
            "arn:aws:iam::12345678910:user/person1",
            "arn:aws:iam::12345678910:user/ci",
            "arn:aws:iam::12345678910:role/appA"
          ]
        }
      }
    }
  ]
}

narrower.key-policy.json

{
  "Version": "2012-10-17",
  "Id": "NarrowerKeyPolicy",
  "Statement": [
    {
      "Sid": "AllowFullAccess",
      "Effect": "Allow",
      "Action": "kms:*",
      "Resource": "*",
      "Principal": {
        "AWS": "*"
      },
      "Condition": {
        "ArnEquals": {
          "aws:PrincipalArn": [
            "arn:aws:iam::12345678910:role/appA",
            "arn:aws:iam::12345678910:user/ci"
          ]
        }
      }
    },
    {
      "Sid": "DenyEveryoneElse",
      "Effect": "Deny",
      "Action": "kms:*",
      "Resource": "*",
      "Principal": {
        "AWS": "*"
      },
      "Condition": {
        "ArnNotEquals": {
          "aws:PrincipalArn": [
            "arn:aws:iam::12345678910:user/ci",
            "arn:aws:iam::12345678910:role/appA"
          ]
        }
      }
    }
  ]
}