kms:CreateCustomKeyStore is a Write access-level action in the kms service. Controls permission to create a custom key store that is backed by an AWS CloudHSM cluster or an external key manager outside of AWS
This action does not support resource-level permissions; use "Resource": "*" in your policy.
Keys you can use in the Condition block of a policy that grants kms:CreateCustomKeyStore.
Filters access to specified AWS KMS operations based on the AWS account ID of the caller. You can use this condition key to allow or deny access to all IAM users and roles in an AWS account in a single policy statement
A minimal policy that allows kms:CreateCustomKeyStore. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKmsCreateCustomKeyStore",
"Effect": "Allow",
"Action": "kms:CreateCustomKeyStore",
"Resource": "*"
}
]
}