Skip to content

Resource: awsKmsKeyPolicy

Attaches a policy to a KMS Key.

Example Usage

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as aws from "./.gen/providers/aws";
const awsKmsKeyExample = new aws.kmsKey.KmsKey(this, "example", {
  description: "example",
});
const awsKmsKeyPolicyExample = new aws.kmsKeyPolicy.KmsKeyPolicy(
  this,
  "example_1",
  {
    keyId: awsKmsKeyExample.id,
    policy:
      '${jsonencode({\n    Id = "example"\n    Statement = [\n      {\n        Action = "kms:*"\n        Effect = "Allow"\n        Principal = {\n          AWS = "*"\n        }\n\n        Resource = "*"\n        Sid      = "Enable IAM User Permissions"\n      },\n    ]\n    Version = "2012-10-17"\n  })}',
  }
);
/*This allows the Terraform resource name to match the original name. You can remove the call if you don't need them to match.*/
awsKmsKeyPolicyExample.overrideLogicalId("example");

Argument Reference

The following arguments are supported:

  • keyId - (Required) The ID of the KMS Key to attach the policy.
  • policy - (Required) A valid policy JSON document. Although this is a key policy, not an IAM policy, an awsIamPolicyDocument, in the form that designates a principal, can be used. For more information about building policy documents with Terraform, see the AWS IAM Policy Document Guide.

\~> NOTE: Note: All KMS keys must have a key policy. If a key policy is not specified, or this resource is destroyed, AWS gives the KMS key a default key policy that gives all principals in the owning account unlimited access to all KMS operations for the key. This default key policy effectively delegates all access control to IAM policies and KMS grants.

  • bypassPolicyLockoutSafetyCheck - (Optional) A flag to indicate whether to bypass the key policy lockout safety check. Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately. If this value is set, and the resource is destroyed, a warning will be shown, and the resource will be removed from state. For more information, refer to the scenario in the Default Key Policy section in the AWS Key Management Service Developer Guide.

Attributes Reference

No additional attributes are exported.

Import

KMS Key Policies can be imported using the keyId, e.g.,

$ terraform import aws_kms_key_policy.a 1234abcd-12ab-34cd-56ef-1234567890ab