AWS Security Cookbook

There's more...

In this recipe, we granted permission to only one operation. We can grant permission to multiple operations like so:

aws kms create-grant \    --key-id 1ab77c7a-7ca4-4387-a4c5-2fba3cb5c0f5 \    --grantee-principal arn:aws:iam::135301570106:user/testuser \    --operations "Encrypt" "Decrypt" \    --profile awssecadmin

Let's quickly go through some important concepts related to granting and revoking permissions programmatically within AWS:

• The supported grant operations are Encrypt, Decrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo, CreateGrant, RetireGrant, and DescribeKey.
• We can use the encrypt subcommand of the AWS KMS API to convert plain text into ciphertext with the help of a key.
• We can use ...