How to create a grant in AWS KMS

Question

Hi guys,

I have created a custom key in AWS KMS. I want to give access with the help of a grant. Can anyone tell me how to create a grant in AWS KMS?

Answer 1

Hi@akhtar,

You can add a grant to a customer master key (CMK). The grant allows the grantee principal to use the CMK when the conditions specified in the grant are met. When setting permissions, grants are an alternative to key policies.

$ aws kms create-grant --key-id ID --grantee-principal arn:aws:iam::123456789012:user/exampleUser --operations Decrypt --constraints EncryptionContextSubset={Department=IT} --retiring-principal arn:aws:iam::123456789012:role/adminRole