Movatterモバイル変換

[0]ホーム
URL:

Troubleshooting AWS KMS permissions - AWS Key Management Service
DocumentationAWS KMSDeveloper Guide
Example 1: User is denied access to a KMS key in their AWS accountExample 2: User assumes role with permission to use a KMS key in a different AWS account

Troubleshooting AWS KMS permissions

When authorizing access to a KMS key, AWS KMS evaluates the following:

  • Thekey policy that is attached to the KMS key. The key policy is always defined in the AWS account and Region that owns the KMS key.

  • AllIAM policies that are attached to the user or role making the request. IAM policies that govern a principal's use of a KMS key are always defined in the principal's AWS account.

  • Allgrants that apply to the KMS key.

  • Other types of policies that might apply to the request to use the KMS key, such asAWS Organizations service control policies andVPC endpoint policies. These policies are optional and allow all actions by default, but you can use them to restrict permissions otherwise given to principals.

AWS KMS evaluates these policy mechanisms together to determine whether access to the KMS key is allowed or denied. To do this, AWS KMS uses a process similar to the one depicted in the following flowchart. The following flowchart provides a visual representation of the policy evaluation process.

Flowchart that describes the policy evaluation process

This flowchart is divided into two parts. The parts appear to be sequential, but they are typically evaluated at the same time.

  • Use authorization determines whether you are permitted to use a KMS key based on its key policy, IAM policies, grants, and other applicable policies.

  • Key trust determines whether you should trust a KMS key that you are permitted to use. In general, you trust the resources in your AWS account. But, you can also feel confident about using KMS keys in a different AWS account if a grant or IAM policy in your account allows you to use the KMS key.

You can use this flowchart to discover why a caller was allowed or denied permission to use a KMS key. You can also use it to evaluate your policies and grants. For example, the flowchart shows that a caller can be denied access by an explicitDENY statement, or by the absence of an explicitALLOW statement, in the key policy, IAM policy, or grant.

The flowchart can explain some common permission scenarios.

Example 1: User is denied access to a KMS key in their AWS account

Alice is an IAM user in the 111122223333 AWS account. She was denied access to a KMS key in same AWS account. Why can't Alice use the KMS key?

In this case, Alice is denied access to the KMS key because there is no key policy, IAM policy, or grant that gives her the required permissions. The key policy of the KMS key allows the AWS account to use IAM policies to control access to the KMS key, but no IAM policy gives Alice permission to use the KMS key.

Flowchart that describes the policy evaluation process

Consider the relevant policies for this example.

Example 2: User assumes role with permission to use a KMS key in a different AWS account

Bob is a user in account 1 (111122223333). He is allowed to use a KMS key in account 2 (444455556666) incryptographic operations. How is this possible?

  • The key policy for the KMS key in account 2 allows account 2 to use IAM policies to control access to the KMS key.

  • The key policy for the KMS key in account 2 allows account 1 to use the KMS key in cryptographic operations. However, account 1 must use IAM policies to give its principals access to the KMS key.

  • An IAM policy in account 1 allows theEngineering role to use the KMS key in account 2 for cryptographic operations.

  • Bob, a user in account 1, has permission to assume theEngineering role.

  • Bob can trust this KMS key, because even though it is not in his account, an IAM policy in his account gives him explicit permission to use this KMS key.

Flowchart that describes the policy evaluation process

Consider the policies that let Bob, a user in account 1, use the KMS key in account 2.

Testing your permissions
Glossary
[8]ページ先頭
©2009-2025 Movatter.jp