AWS managed policies for AWS Key Management Service

An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.

Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they're available for all AWS customers to use. We recommend that you reduce permissions further by defining customer managed policies that are specific to your use cases.

You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services.

For more information, see AWS managed policies in the IAM User Guide.

AWS managed policy: AWSKeyManagementServicePowerUser

You can attach the AWSKeyManagementServicePowerUser policy to your IAM identities.

You can use the AWSKeyManagementServicePowerUser managed policy to give IAM principals in your account the permissions of a power user. Power users can create KMS keys, use and manage the KMS keys they create, and view all KMS keys and IAM identities. Principals who have the AWSKeyManagementServicePowerUser managed policy can also get permissions from other sources, including key policies, other IAM policies, and grants.

AWSKeyManagementServicePowerUser is an AWS managed IAM policy. For more information about AWS managed policies, see AWS managed policies in the IAM User Guide.

The AWSKeyManagementServicePowerUser managed IAM policy includes the following permissions.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kms:CreateAlias",
                "kms:CreateKey",
                "kms:DeleteAlias",
                "kms:Describe*",
                "kms:GenerateRandom",
                "kms:Get*",
                "kms:List*",
                "kms:TagResource",
                "kms:UntagResource",
                "iam:ListGroups",
                "iam:ListRoles",
                "iam:ListUsers"
            ],
            "Resource": "*"
        }
    ]
}

AWS managed policy: AWSServiceRoleForKeyManagementServiceCustomKeyStores

You can't attach AWSServiceRoleForKeyManagementServiceCustomKeyStores to your IAM entities. This policy is attached to a service-linked role that gives AWS KMS permission to view the AWS CloudHSM clusters associated with your AWS CloudHSM key store and create the network to support a connection between your custom key store and its AWS CloudHSM cluster. For more information, see Authorizing AWS KMS to manage AWS CloudHSM and Amazon EC2 resources.

AWS managed policy: AWSServiceRoleForKeyManagementServiceMultiRegionKeys

You can't attach AWSServiceRoleForKeyManagementServiceMultiRegionKeys to your IAM entities. This policy is attached to a service-linked role that gives AWS KMS permission to synchronize any changes to the key material of a multi-Region primary key to its replica keys. For more information, see Authorizing AWS KMS to synchronize multi-Region keys.

AWS KMS updates to AWS managed policies

View details about updates to AWS managed policies for AWS KMS since this service began tracking these changes. For automatic alerts about changes to this page, subscribe to the RSS feed on the AWS KMS Document history page.