AWSKeyManagementServicePowerUser

Practical scope

The policy allows kms:CreateAlias, kms:CreateKey, kms:DeleteAlias, kms:Describe*, kms:GenerateRandom, kms:Get*, kms:List*, kms:TagResource and kms:UntagResource, plus iam:ListGroups, iam:ListRoles and iam:ListUsers, on Resource "*". It does not allow principals to use or manage KMS keys that they didn't create. Principals with this policy can also get permissions from other sources, including key policies, other IAM policies and grants.

Use cases

• Give a principal the permissions of a KMS power user: creating KMS keys, managing aliases and tags, and viewing all KMS keys and IAM users, groups and roles.

Prerequisites

• Permissions that are specific to a KMS key, such as kms:TagResource and kms:GetKeyRotationStatus, are effective only when the key policy for that KMS key explicitly allows the AWS account to use IAM policies to control access to the key.
• To view the AWS KMS console without errors, the principal needs tag:GetResources, which is not included in this policy. You can allow it in a separate IAM policy.

Best practices

• AWS managed policies might not grant least-privilege permissions for your use case. AWS recommends reducing permissions further with customer managed policies specific to your use cases.

Security considerations

• Creating a KMS key includes setting the key policy, so power users can give themselves and others permission to use and manage the KMS keys they create.
• The policy allows creating and deleting aliases and tags on all KMS keys. Changing a tag or alias can allow or deny permission to use and manage the KMS key.
• The policy gives a power user permissions on any KMS key with a key policy that permits the operation. For cross-account permissions such as kms:DescribeKey and kms:ListGrants, this might include KMS keys in untrusted AWS accounts.
• You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

You can attach this policy to your IAM identities. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It is intended to give IAM principals in your account the permissions of a KMS power user. It leaves out tag:GetResources, so add that separately if the principal needs the KMS console.

AWS CLICopy

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser

CloudFormationCopy

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser

TerraformCopy

resource "aws_iam_role_policy_attachment" "awskeymanagementservicepoweruser" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser"
}

CDK (TypeScript)Copy

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSKeyManagementServicePowerUser"),
);