AWS Security Cookbook

Using key policies with conditional keys

In this recipe, we will learn how to use key policies, especially with key policy conditions. Resource-based policies attached to CMKs are called key policies. For managing access to KMS resources, we can use key policies alone, or we can use IAM policies and grants along with key policies.

In general, permissions policies specify the resources that access has to be provided to, what actions are provided, and who gets those permissions. We can attach policies to IAM identities such as users, groups, roles, and more, called IAM policies, or to services such as S3, KMS, and more, which are known as resource-based policies.