kms:CancelKeyDeletion
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
ConnectCustomKeyStorekms:ConnectCustomKeyStore
*
kms:CreateAlias
To use this operation, the caller needs kms:CreateAlias permission on two resources:
The alias (in an IAM policy)
The KMS key (in a key policy)
For details, see Controlling access to aliases.
IAM policy (for the alias)
NoAlias
None (when controlling access to the alias)Key policy (for the KMS key)
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
CreateCustomKeyStorekms:CreateCustomKeyStore
*
kms:CreateGrant
Key policy
YesKMS key
Encryption context conditions:
kms:EncryptionContext:context-key
Grant conditions:
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:CreateKey
IAM policy
No*
kms:BypassPolicyLockoutSafetyCheck
aws:RequestTag/tag-key (AWS global condition key)
aws:ResourceTag/tag-key (AWS global condition key)
aws:TagKeys (AWS global condition key)
kms:Decrypt
Key policy
YesKMS key
Conditions for cryptographic operations
Encryption context conditions:
kms:EncryptionContext:context-key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:DeleteAlias
To use this operation, the caller needs kms:DeleteAlias permission on two resources:
The alias (in an IAM policy)
The KMS key (in a key policy)
For details, see Controlling access to aliases.
IAM policy (for the alias)
NoAlias
None (when controlling access to the alias)Key policy (for the KMS key)
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
DeleteCustomKeyStorekms:DeleteCustomKeyStore
*
kms:DeleteImportedKeyMaterial
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
DeriveSharedSecretkms:DeriveSharedSecret
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Conditions for cryptographic operations: DescribeCustomKeyStoreskms:DescribeCustomKeyStores
*
kms:DescribeKey
Key policy
YesKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Other conditions:
kms:DisableKey
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:DisableKeyRotation
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
DisconnectCustomKeyStorekms:DisconnectCustomKeyStore
*
kms:EnableKey
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:EnableKeyRotation
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Automatic key rotation conditions:
kms:Encrypt
Key policy
YesKMS key
Conditions for cryptographic operations
Encryption context conditions:
kms:EncryptionContext:context-key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:GenerateDataKey
Key policy
YesKMS key
Conditions for cryptographic operations
Encryption context conditions:
kms:EncryptionContext:context-key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:GenerateDataKeyPair
Key policy
YesKMS key
Generates an asymmetric data key pair that is protected by a symmetric encryption KMS key.
Conditions for data key pairs:
Conditions for cryptographic operations
Encryption context conditions:
kms:EncryptionContext:context-key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
GenerateDataKeyPairWithoutPlaintext
kms:GenerateDataKeyPairWithoutPlaintext
Key policy
YesKMS key
Generates an asymmetric data key pair that is protected by a symmetric encryption KMS key.
Conditions for data key pairs:
Conditions for cryptographic operations
Encryption context conditions:
kms:EncryptionContext:context-key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
GenerateDataKeyWithoutPlaintext
kms:GenerateDataKeyWithoutPlaintext
Key policy
YesKMS key
Conditions for cryptographic operations
Encryption context conditions:
kms:EncryptionContext:context-key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
GenerateMackms:GenerateMac
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Conditions for cryptographic operations:kms:GenerateRandom
IAM policy
N/A*
kms:GetKeyPolicy
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:GetKeyRotationStatus
Key policy
YesKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:GetParametersForImport
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:GetPublicKey
Key policy
YesKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Other conditions:
kms:ImportKeyMaterial
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Other conditions:
kms:ExpirationModelkms:ListAliases
IAM policy
No*
kms:ListGrants
Key policy
YesKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Other conditions:
kms:ListKeyPolicies
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:ListKeyRotations
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:ListKeys
IAM policy
No*
kms:ListResourceTags
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:ListRetirableGrants
IAM policy
The specified principal must be in the local account, but the operation returns grants in all accounts.*
kms:PutKeyPolicy
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Other conditions:
kms:BypassPolicyLockoutSafetyCheck
kms:ReEncryptFrom
kms:ReEncryptTo
To use this operation, the caller needs permission on two KMS keys:
kms:ReEncryptFrom on the KMS key used to decrypt
kms:ReEncryptTo on the KMS key used to encrypt
Key policy
YesKMS key
Conditions for cryptographic operations
Encryption context conditions:
kms:EncryptionContext:context-key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Other conditions:
kms:ReplicateKey
To use this operation, the caller needs the following permissions:
kms:ReplicateKey on the multi-Region primary key
kms:CreateKey in an IAM policy in the replica Region
Key policy
No
KMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Other conditions:
kms:RetireGrant
Permission to retire a grant is determined primarily by the grant. A policy alone cannot allow access to this operation. For more information, see Retiring and revoking grants.
IAM policy
(This permission is not effective in a key policy.)
YesKMS key
Encryption context conditions:
kms:EncryptionContext:context-key
Grant conditions:
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:RevokeGrant
Key policy
YesKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Other conditions:
kms:RotateKeyOnDemand
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:ScheduleKeyDeletion
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:Sign
Key policy
YesKMS key
Conditions for signing and verification:
kms:RequestAliasConditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:TagResource
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Conditions for tagging:
aws:RequestTag/tag-key (AWS global condition key)
aws:TagKeys (AWS global condition key)
kms:UntagResource
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Conditions for tagging:
aws:RequestTag/tag-key (AWS global condition key)
aws:TagKeys (AWS global condition key)
kms:UpdateAlias
To use this operation, the caller needs kms:UpdateAlias permission on three resources:
The alias
The currently associated KMS key
The newly associated KMS key
For details, see Controlling access to aliases.
IAM policy (for the alias)
NoAlias
None (when controlling access to the alias)Key policy (for the KMS keys)
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
UpdateCustomKeyStorekms:UpdateCustomKeyStore
*
kms:UpdateKeyDescription
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
kms:UpdatePrimaryRegion
To use this operation, the caller needs kms:UpdatePrimaryRegion permission on both the multi-Region primary key that will become a replica key and the multi-Region replica key that will become the primary key.
Key policy
NoKMS key
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Other conditions
kms:Verify
Key policy
YesKMS key
Conditions for signing and verification:
kms:RequestAliasConditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
VerifyMackms:VerifyMac
Conditions for KMS key operations:
aws:ResourceTag/tag-key (AWS global condition key)
Conditions for cryptographic operations:RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4