AWS › AWS KMS & Data Encryption

How do KMS key policies and grants control who can use a specific encryption key?

Intermediate

Answer

A key policy is the primary mechanism for controlling access to a KMS key, defining exactly which IAM principals can perform actions such as encrypting, decrypting, or managing the key, and it must explicitly grant access since KMS key policies do not automatically inherit permissions the way some other AWS resources do, while grants provide a more temporary and delegated way to give specific permissions to a principal, often used for short lived or programmatic access scenarios.

aws kms put-key-policy --key-id abc123 --policy-name default --policy file://updated-key-policy.json

Real-world example A company restricts its most sensitive KMS key's policy to allow decryption only from a specific application's IAM role, ensuring that even administrators with broad account permissions cannot decrypt that particular sensitive data without an explicit, separately granted exception.

Common follow-ups: Why don't KMS key policies automatically inherit permissions like other AWS resource policies often do?;What is the difference between a key policy and a grant in terms of how long access lasts?

IAM;AWS CloudTrail & Auditing