本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 设置客户管理的密钥政策
<a name="kms-key-policy-configuration"></a>

**注意**  
目前，我们不支持通过控制台在代币库上配置 CMK。

要使用客户管理的密钥，您的密钥必须信任 Amazon Bedrock AgentCore Identity 服务主体才能对密钥执行加密和解密操作。配置您的 KMS 密[钥](https://docs.amazonaws.cn/kms/latest/developerguide/key-policies.html)的密钥策略，如以下示例所示。编写此策略的 IAM 委托人必须拥有对您的 KMS 密钥的写入权限，并获得`kms:PutKeyPolicy`许可。

```
{
    "Id": "identity-service-cmk-policy",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BedrockAgentCoreIdentityKMSAccess",
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:GenerateDataKeyWithoutPlaintext"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "kms:ViaService": "bedrock-agentcore-identity.*.amazonaws.com"
                },
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                },
                "ArnLike": {
                    "kms:EncryptionContext:aws-crypto-ec:aws:bedrock-agentcore-identity:token-vault-arn": "arn:aws:bedrock-agentcore:*:*:token-vault/default"
                }
            }
        },
        {
            "Sid": "BedrockAgentCoreIdentityDescribeKeyKMSAccess",
            "Effect": "Allow",
            "Action": [
                "kms:DescribeKey"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                },
                "StringLike": {
                    "kms:ViaService": "bedrock-agentcore-identity.*.amazonaws.com"
                }
            }
        }
    ]
}
```