Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Default key policy

When you create a KMS key, you can specify the key policy for the new KMS key. If you don't provide one, Amazon KMS creates one for you. The default key policy that Amazon KMS uses differs depending on whether you create the key in the Amazon KMS console or you use the Amazon KMS API.

Default key policy when you create a KMS key programmatically

When you create a KMS key programmatically with the Amazon KMS API (including by using the Amazon SDKs, Amazon Command Line Interface or Amazon Tools for PowerShell), and you don't specify a key policy, Amazon KMS applies a very simple default key policy. This default key policy has one policy statement that gives the Amazon Web Services account that owns the KMS key permission to use IAM policies to allow access to all Amazon KMS operations on the KMS key. For more information about this policy statement, see Allows access to the Amazon Web Services account and enables IAM policies.

Default key policy when you create a KMS key with the Amazon Web Services Management Console

When you create a KMS key with the Amazon Web Services Management Console, the key policy begins with the policy statement that allows access to the Amazon Web Services account and enables IAM policies. The console then adds a key administrators statement, a key users statement, and (for most key types) a statement that allows principals to use the KMS key with other Amazon services. You can use the features of the Amazon KMS console to specify the IAM users, IAMroles, and Amazon Web Services accounts who are key administrators and those who are key users (or both).

Permissions

Allows access to the Amazon Web Services account and enables IAM policies

The following default key policy statement is critical.

The following key policy statement is the entire default key policy for KMS keys created programmatically. It's the first policy statement in the default key policy for KMS keys created in the Amazon KMS console.

{
  "Sid": "Enable IAM User Permissions",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::111122223333:root"
   },
  "Action": "kms:*",
  "Resource": "*"
}

Allows key administrators to administer the KMS key

The default key policy created by the console allows you to choose IAM users and roles in the account and make them key administrators. This statement is called the key administrators statement. Key administrators have permissions to manage the KMS key, but do not have permissions to use the KMS key in cryptographic operations. You can add IAM users and roles to the list of key administrators when you create the KMS key in the default view or the policy view.

The following example shows the key administrators statement in the default view of the Amazon KMS console.

The following is an example key administrators statement in the policy view of the Amazon KMS console. This key administrators statement is for a single-region symmetric encryption KMS key.

{
  "Sid": "Allow access for Key Administrators",
  "Effect": "Allow",
  "Principal": {"AWS":"arn:aws:iam::111122223333:role/ExampleAdminRole"},
  "Action": [
    "kms:Create*",
    "kms:Describe*",
    "kms:Enable*",
    "kms:List*",
    "kms:Put*",
    "kms:Update*",
    "kms:Revoke*",
    "kms:Disable*",
    "kms:Get*",
    "kms:Delete*",
    "kms:TagResource",
    "kms:UntagResource",
    "kms:ScheduleKeyDeletion",
    "kms:CancelKeyDeletion"
  ],
  "Resource": "*"
}

The default key administrators statement for the most common KMS key, a single-Region symmetric encryption KMS key, allows the following permissions. For detailed information about each permission, see the Amazon KMS permissions.

When you use the Amazon KMS console to create a KMS key, the console adds the users and roles you specify to the Principal element in the key administrators statement.

Many of these permissions contain the wildcard character (*), which allows all permissions that begin with the specified verb. As a result, when Amazon KMS adds new API operations, key administrators are automatically allowed to use them. You don't have to update your key policies to include the new operations. If you prefer to limit your key administrators to a fixed set of API operations, you can change your key policy.

 

Amazon KMS adds the following permissions to the default key administrators statement when you create special-purpose keys.

Allows key users to use the KMS key

The default key policy that the console creates for KMS keys allows you to choose IAM users and IAM roles in the account, and external Amazon Web Services accounts, and make them key users.

The console adds two policy statements to the key policy for key users.

You can add IAM users, IAM roles, and other Amazon Web Services accounts to the list of key users when you create the KMS key. You can also edit the list with the console's default view for key policies, as shown in the following image. The default view for key policies is on the key details page. For more information about allowing users in other Amazon Web Services accounts to use the KMS key, see Allowing users in other accounts to use a KMS key.

The default key users statements for a single-Region symmetric allows the following permissions. For detailed information about each permission, see the Amazon KMS permissions.

When you use the Amazon KMS console to create a KMS key, the console adds the users and roles you specify to the Principal element in each key users statement.

{
  "Sid": "Allow use of the key",
  "Effect": "Allow",
  "Principal": {"AWS": [
    "arn:aws:iam::111122223333:role/ExampleRole",
    "arn:aws:iam::444455556666:root"
  ]},
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:ReEncrypt*",
    "kms:GenerateDataKey*",
    "kms:DescribeKey"
  ],
  "Resource": "*"
},
{
  "Sid": "Allow attachment of persistent resources",
  "Effect": "Allow",
  "Principal": {"AWS": [
    "arn:aws:iam::111122223333:role/ExampleRole",
    "arn:aws:iam::444455556666:root"
  ]},
  "Action": [
    "kms:CreateGrant",
    "kms:ListGrants",
    "kms:RevokeGrant"
  ],
  "Resource": "*",
  "Condition": {"Bool": {"kms:GrantIsForAWSResource": true}}
}

Allows key users to use a KMS key for cryptographic operations

Key users have permission to use the KMS key directly in all cryptographic operations supported on the KMS key. They can also use the DescribeKey operation to get detailed information about the KMS key in the Amazon KMS console or by using the Amazon KMS API operations.

By default, the Amazon KMS console adds key users statements like those in the following examples to the default key policy. Because they support different API operations, the actions in the policy statements for symmetric encryption KMS keys, HMAC KMS keys, asymmetric KMS keys for public key encryption, and asymmetric KMS keys for signing and verification are slightly different.

The actions in these statements give the key users the following permissions.

Allows key users to use the KMS key with Amazon services

The default key policy in the console also gives key users the grant permissions they need to protect their data in Amazon services that use grants. Amazon services often use grants to get specific and limited permission to use a KMS key.

This key policy statement allows the key user to create, view, and revoke grants on the KMS key, but only when the grant operation request comes from an Amazon service integrated with Amazon KMS. The kms:GrantIsForAWSResource policy condition doesn't allow the user to call these grant operations directly. When the key user allows it, an Amazon service can create a grant on the user's behalf that allows the service to use the KMS key to protect the user's data.

Key users require these grant permissions to use their KMS key with integrated services, but these permissions are not sufficient. Key users also need permission to use the integrated services. For details about giving users access to an Amazon service that integrates with Amazon KMS, consult the documentation for the integrated service.

{
  "Sid": "Allow attachment of persistent resources",
  "Effect": "Allow",
  "Principal": {"AWS": "arn:aws:iam::111122223333:role/ExampleKeyUserRole"},
  "Action": [
    "kms:CreateGrant",
    "kms:ListGrants",
    "kms:RevokeGrant"
  ],
  "Resource": "*",
  "Condition": {"Bool": {"kms:GrantIsForAWSResource": true}}
}

For example, key users can use these permissions on the KMS key in the following ways.

The default key policy allows key users to delegate their grant permission to all integrated services that use grants. However, you can create a custom key policy that restricts the permission to specified Amazon services. For more information, see the kms:ViaService condition key.