KMS
Prefix kms, 58 actions · Domain Security, Identity & Compliance
58 AWS managed policies. 8 have reviewed guidance; the rest have authoritative permission data pending editorial review. 12 are service-linked role policies, shown with permission data only.
User access (7)
Operator and limited (23)
- AgentRegistryFullAccessOperator
- AmazonDataZonePreviewConsoleFullAccessOperator
- AmazonSageMakerJobRuntimeAccessOperator
- AmazonSageMakerModelRegistryFullAccessOperator
- AmazonSageMakerSpacesControllerPolicyOperator
- AmazonSageMakerSpacesRouterPolicyOperator
- AmazonSageMakerTrainingSessionFullAccessOperator
- AmazonSecurityLakePermissionsBoundaryHigh privilegeOperator
- AWS-SSM-DiagnosisAutomation-AdministrationRolePolicyOperator
- AWS-SSM-RemediationAutomation-AdministrationRolePolicyOperator
- AWS-SSM-RemediationAutomation-ExecutionRolePolicyOperator
- AWSBackupGuardDutyRolePolicyForScansOperator
- AWSBackupSearchOperatorAccessOperator
- AWSBackupServiceRolePolicyForIndexingOperator
- AWSBackupServiceRolePolicyForItemRestoresOperator
- AWSBackupServiceRolePolicyForS3RestoreOperator
- AWSKeyManagementServicePowerUserOperator
- AWSSecretsManagerClientReadOnlyAccessOperator
- AWSSystemsManagerJustInTimeAccessTokenPolicyOperator
- AWSSystemsManagerJustInTimeAccessTokenSessionPolicyOperator
- AWSTransformSecretsManagerConnectorPolicyOperator
- CloudWatchAPIKeyAccessOperator
- CloudWatchLogsAPIKeyAccessOperator
Service roles (16)
- AmazonS3TablesLakeFormationServiceRoleOperator
- AWSIdentityCenterExternalManagementPolicyOperator
- AWSTransformApplicationDeploymentPolicyOperator
- ROSAAmazonEBSCSIDriverOperatorPolicyOperator
- ROSAKarpenterControllerPolicyOperator
- ROSAKMSProviderPolicyOperator
- ROSANodePoolManagementPolicyOperator
- SageMakerStudioBedrockChatAgentUserRolePolicyOperator
- SageMakerStudioBedrockEvaluationJobServiceRolePolicyOperator
- SageMakerStudioBedrockFlowServiceRolePolicyOperator
- SageMakerStudioBedrockFunctionExecutionRolePolicyOperator
- SageMakerStudioBedrockKnowledgeBaseServiceRolePolicyOperator
- SageMakerStudioBedrockPromptUserRolePolicyOperator
- SageMakerStudioDomainServiceRolePolicyOperator
- SageMakerStudioEMRInstanceRolePolicyOperator
- SageMakerStudioEMRServiceRolePolicyOperator
Service-linked roles (12)
- AmazonChimeSDKMessagingServiceRolePolicyOperator
- AmazonEventBridgeApiDestinationsServiceRolePolicyOperator
- AmazonGuardDutyMalwareProtectionServiceRolePolicyOperator
- AmazonInspector2AgentlessServiceRolePolicyOperator
- AmazonInspector2AmiScanServiceRolePolicyOperator
- AWSKeyManagementServiceMultiRegionKeysServiceRolePolicyOperator
- AWSObservabilityAdminLogsCentralizationServiceRolePolicyOperator
- AWSServiceRoleForLogDeliveryPolicyOperator
- DynamoDBKinesisReplicationServiceRolePolicyOperator
- WAFLoggingServiceRolePolicyOperator
- WAFRegionalLoggingServiceRolePolicyOperator
- WAFV2LoggingServiceRolePolicyOperator
Also grants KMS actions (174)
- AccessAnalyzerServiceRolePolicy
- AdministratorAccess
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AIOpsConsoleAdminPolicy
- AlexaForBusinessFullAccess
- AlexaForBusinessLifesizeDelegatedAccessPolicy
- AmazonBedrockFullAccess
- AmazonBedrockLimitedAccess
- AmazonBedrockStudioPermissionsBoundary
- AmazonBioDiscoveryFullAccess
- AmazonBioDiscoveryInAppFullAccess
- AmazonCognitoUnAuthedIdentitiesSessionPolicy
- AmazonConnect_FullAccess
- AmazonConnectServiceLinkedRolePolicy
- AmazonConnectSynchronizationServiceRolePolicy
- AmazonDataZoneEnvironmentRolePermissionsBoundary
- AmazonDataZoneFullAccess
- AmazonDataZoneGlueManageAccessRolePolicy
- AmazonDataZoneProjectDeploymentPermissionsBoundary
- AmazonDataZoneProjectRolePermissionsBoundary
- AmazonDataZoneRedshiftGlueProvisioningPolicy
- AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
- AmazonDataZoneSageMakerManageAccessRolePolicy
- AmazonDataZoneSageMakerProvisioningRolePolicy
- AmazonDocDBConsoleFullAccess
- AmazonDocDBElasticFullAccess
- AmazonDocDBFullAccess
- AmazonDynamoDBFullAccess
- AmazonDynamoDBFullAccess_v2
- AmazonDynamoDBReadOnlyAccess
- AmazonEKSClusterPolicy
- AmazonElastiCacheFullAccess
- AmazonElasticFileSystemFullAccess
- AmazonElasticFileSystemReadOnlyAccess
- AmazonElasticFileSystemServiceRolePolicy
- AmazonElasticMapReduceFullAccess
- AmazonEVSServiceRolePolicy
- AmazonFSxConsoleFullAccess
- AmazonFSxConsoleReadOnlyAccess
- AmazonKendraFullAccess
- AmazonKeyspacesFullAccess
- AmazonLaunchWizard_Fullaccess
- AmazonLaunchWizardFullAccessV2
- AmazonLexFullAccess
- AmazonLookoutEquipmentFullAccess
- AmazonLookoutVisionConsoleFullAccess
- AmazonManagedBlockchainConsoleFullAccess
- AmazonMSKFullAccess
- AmazonMSKReadOnlyAccess
- AmazonRDSCustomInstanceProfileRolePolicy
- AmazonRedshiftQueryEditorV2FullAccess
- AmazonRedshiftServiceLinkedRolePolicy
- AmazonSageMakerCanvasDataPrepFullAccess
- AmazonSageMakerCanvasFullAccess
- AmazonSageMakerFullAccess
- AmazonSageMakerHyperPodInferenceAccess
- AmazonSageMakerJobFullAccess
- AmazonSageMakerModelCustomizationCoreAccess
- AmazonSageMakerModelGovernanceUseAccess
- AmazonSageMakerNotebooksServiceRolePolicy
- AmazonSageMakerTrainingSessionAccess
- AmazonSecurityLakeAdministrator
- AmazonTimestreamConsoleFullAccess
- AmazonTimestreamFullAccess
- AmazonTimestreamInfluxDBServiceRolePolicy
- AmazonWorkMailFullAccess
- AmazonWorkSpacesAdmin
- AnthropicFullAccess
- AnthropicReadOnlyAccess
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy
- AWSAppFabricFullAccess
- AWSApplicationMigrationFullAccess
- AWSApplicationMigrationServiceRolePolicy
- AWSAuditManagerAdministratorAccess
- AWSAuditManagerServiceRolePolicy
- AWSBackupAccessPointOperatorAccess
- AWSBackupFullAccess
- AWSBackupServiceLinkedRolePolicyForBackup
- AWSBackupServiceRolePolicyForBackup
- AWSBackupServiceRolePolicyForRestores
- AWSBackupServiceRolePolicyForS3Backup
- AWSCloudTrail_FullAccess
- AWSCODAPermissionsBoundary
- AWSConfigServiceRolePolicy
- AWSDataExchangeFullAccess
- AWSDataExchangeProviderFullAccess
- AWSDataExchangeSubscriberFullAccess
- AWSDataSyncFullAccess
- AWSDeadlineCloud-UserAccessFarms
- AWSElasticDisasterRecoveryConsoleFullAccess
- AWSElasticDisasterRecoveryConsoleFullAccess_v2
- AWSElasticDisasterRecoveryServiceRolePolicy
- AWSEntityResolutionConsoleFullAccess
- AWSFaultInjectionSimulatorEC2Access
- AWSGlueConsoleFullAccess
- AWSGlueConsoleSageMakerNotebookFullAccess
- AwsGlueDataBrewFullAccessPolicy
- AWSLambda_FullAccess
- AWSLambda_ReadOnlyAccess
- AWSLambdaFullAccess
- AWSLicenseManagerLinuxSubscriptionsServiceRolePolicy
- AWSMcpServiceActionsFullAccess
- AWSMigrationHubOrchestratorConsoleFullAccess
- AWSObservabilityAdminTelemetryEnablementServiceRolePolicy
- AWSProtonFullAccess
- AWSRefactoringToolkitFullAccess
- AWSResourceExplorerServiceRolePolicy
- AWSServiceRoleForAWSTransform
- AWSServiceRoleForCodeWhispererPolicy
- AWSServiceRoleForImageBuilder
- AWSServiceRoleForMonitronPolicy
- AWSServiceRoleForUserSubscriptions
- AWSSSODirectoryAdministrator
- AWSSSODirectoryReadOnly
- AWSSSOMasterAccountAdministrator
- AWSSSOMemberAccountAdministrator
- AWSSSOReadOnly
- AWSSupplyChainFederationAdminAccess
- AWSSupportServiceRolePolicy
- AWSSystemsManagerChangeManagementServicePolicy
- AWSSystemsManagerJustInTimeAccessServicePolicy
- AWSThinkboxAWSPortalAdminPolicy
- AWSTransformApplicationECSDeploymentPolicy
- AWSTransformInfrastructureExecutorAccessBatch
- AWSTransformInfrastructureExecutorAccessEC2
- AWSTransformNetworkMigrationAgentPolicy
- AWSTransformServerMigrationAgentPolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- BedrockAgentCoreFullAccess
- CloudWatchFullAccessV2
- CloudWatchOmniAWSIntegrationPolicy
- CloudWatchOmniSpaceAccessPolicy
- CloudWatchSyntheticsFullAccess
- DatabaseAdministrator
- DataScientist
- DBModDiscoveryAndAssessment
- DBModVirtualSource
- EC2FastLaunchServiceRolePolicy
- EC2ImageBuilderExecutionPolicy
- EC2InstanceProfileForImageBuilder
- EC2InstanceProfileForImageBuilderECRContainerBuilds
- MultiPartyApprovalFullAccess
- MultiPartyApprovalReadOnlyAccess
- NeptuneConsoleFullAccess
- NeptuneFullAccess
- NeptuneGraphReadOnlyAccess
- NeptuneReadOnlyAccess
- PowerUserAccess
- ReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
- ROSAInstallerPolicy
- ROSAKubeControllerPolicy
- SageMakerStudioAdminIAMConsolePolicy
- SageMakerStudioAdminIAMDefaultExecutionPolicy
- SageMakerStudioAdminIAMPermissiveExecutionPolicy
- SageMakerStudioBedrockAgentServiceRolePolicy
- SageMakerStudioFullAccess
- SageMakerStudioProjectProvisioningRolePolicy
- SageMakerStudioProjectRoleMachineLearningPolicy
- SageMakerStudioProjectUserRolePermissionsBoundary
- SageMakerStudioProjectUserRolePolicy
- SageMakerStudioUserIAMConsolePolicy
- SageMakerStudioUserIAMDefaultExecutionPolicy
- SageMakerStudioUserIAMPermissiveExecutionPolicy
- SecretsManagerReadWrite
- SecurityAudit
- SupportUser
- SystemAdministrator
- ViewOnlyAccess
- WellArchitectedAgentResourceScanning
cancelkeydeletion connectcustomkeystore createalias createcustomkeystore creategrant createkey decapsulate decrypt deletealias deletecustomkeystore deleteimportedkeymaterial derivesharedsecret describecustomkeystores describekey disablekey disablekeyrotation disconnectcustomkeystore enablekey enablekeyrotation encapsulate encrypt generatedatakey generatedatakeypair generatedatakeypairwithoutplaintext generatedatakeywithoutplaintext generatemac generaterandom getkeylastusage getkeypolicy getkeyrotationstatus getparametersforimport getpublickey importkeymaterial listaliases listgrants listkeypolicies listkeyrotations listkeys listresourcetags listretirablegrants putkeypolicy reencryptfrom reencryptto replicatekey retiregrant revokegrant rotatekeyondemand schedulekeydeletion sign synchronizemultiregionkey tagresource untagresource updatealias updatecustomkeystore updatekeydescription updateprimaryregion verify verifymac
Actions (58)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| kms:CancelKeyDeletion | Write | 4 | 1 |
| kms:ConnectCustomKeyStore | Write | 4 | 1 |
| kms:CreateAlias | Write | 7 | 1 |
| kms:CreateCustomKeyStore | Write | 4 | 1 |
| kms:CreateGrant | Permissions management | 5 | 45 |
| kms:CreateKey | Write | 7 | 2 |
| kms:Decapsulate | Write | 4 | 1 |
| kms:Decrypt | Write | 6 | 111 |
| kms:DeleteAlias | Write | 6 | 1 |
| kms:DeleteCustomKeyStore | Write | 4 | 1 |
| kms:DeleteImportedKeyMaterial | Write | 4 | 1 |
| kms:DeriveSharedSecret | Write | 4 | 1 |
| kms:DescribeCustomKeyStores | Read | 12 | 3 |
| kms:DescribeKey | Read | 82 | 61 |
| kms:DisableKey | Write | 4 | 1 |
| kms:DisableKeyRotation | Write | 4 | 2 |
| kms:DisconnectCustomKeyStore | Write | 4 | 1 |
| kms:EnableKey | Write | 4 | 1 |
| kms:EnableKeyRotation | Write | 4 | 2 |
| kms:Encapsulate | Write | 4 | 1 |
| kms:Encrypt | Write | 6 | 30 |
| kms:GenerateDataKey | Write | 7 | 69 |
| kms:GenerateDataKeyPair | Write | 5 | 1 |
| kms:GenerateDataKeyPairWithoutPlaintext | Write | 5 | 1 |
| kms:GenerateDataKeyWithoutPlaintext | Write | 5 | 24 |
| kms:GenerateMac | Write | 4 | 1 |
| kms:GenerateRandom | Write | 7 | 1 |
| kms:GetKeyLastUsage | Read | 9 | 2 |
| kms:GetKeyPolicy | Read | 19 | 4 |
| kms:GetKeyRotationStatus | Read | 17 | 4 |
| kms:GetParametersForImport | Read | 11 | 2 |
| kms:GetPublicKey | Read | 11 | 4 |
| kms:ImportKeyMaterial | Write | 4 | 1 |
| kms:ListAliases | List | 91 | 8 |
| kms:ListGrants | List | 21 | 9 |
| kms:ListKeyPolicies | List | 22 | 2 |
| kms:ListKeyRotations | List | 15 | 2 |
| kms:ListKeys | List | 50 | 8 |
| kms:ListResourceTags | List | 20 | 6 |
| kms:ListRetirableGrants | List | 23 | 3 |
| kms:PutKeyPolicy | Permissions management | 4 | 2 |
| kms:ReEncryptFrom | Write | 6 | 21 |
| kms:ReEncryptTo | Write | 6 | 20 |
| kms:ReplicateKey | Write | 4 | 1 |
| kms:RetireGrant | Permissions management | 4 | 2 |
| kms:RevokeGrant | Permissions management | 4 | 3 |
| kms:RotateKeyOnDemand | Write | 4 | 1 |
| kms:ScheduleKeyDeletion | Write | 4 | 2 |
| kms:Sign | Write | 4 | 3 |
| kms:SynchronizeMultiRegionKey | Write | 5 | 1 |
| kms:TagResource | Tagging | 6 | 2 |
| kms:UntagResource | Tagging | 6 | 1 |
| kms:UpdateAlias | Write | 4 | 1 |
| kms:UpdateCustomKeyStore | Write | 4 | 1 |
| kms:UpdateKeyDescription | Write | 4 | 1 |
| kms:UpdatePrimaryRegion | Write | 4 | 1 |
| kms:Verify | Write | 4 | 3 |
| kms:VerifyMac | Write | 4 | 1 |