AWS KMS Access Control: Key Policies vs. IAM Permissions Explained

AWS KMS Key Policy vs IAM Policy

AWS KMS uses resource-level key policies to define which entities (like the root user) can perform actions on each key.

By default, the root user’s key policy grants full KMS permissions, effectively delegating further access control to AWS IAM.

You can grant or restrict permissions either by attaching IAM policies to users/roles (e.g., GenerateDataKey for “test-user”) or by adding statements directly in the key policy.