AWS Security Cookbook

Using the key as a non-admin user from account 2

To use the CMK as a non-admin user, the root or the admin user of account 2 has to delegate the permission to the non-admin user by following these steps:

1. Go to the IAM dashboard.
2. Click on Policies.
3. Click on Create policy.
4. Go to the JSON tab.
5. Enter the following policy:

{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "Delegate CMK access from 135301570106",      "Effect": "Allow",      "Action": [        "kms:Encrypt",        "kms:Decrypt",        "kms:ReEncrypt*",        "kms:GenerateDataKey*",        "kms:DescribeKey"      ],      "Resource": "arn:aws:kms:us-east-1:135301570106:key/d791248f-c742-4ed9-a081-cfa314dd6903"    }  ]}

6. Click on Review policy.
7. Provide a name and description for our policy.
8. Click on Create policy.
9. Click Users.
10. Click ...