kms:CreateGrant is a Permissions management access-level action in the kms service. Controls permission to add a grant to an AWS KMS key. You can use grants to add permissions without changing the key policy or IAM policy
ARNs that kms:CreateGrant can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants kms:CreateGrant.
Filters access to specified AWS KMS operations based on the AWS account ID of the caller. You can use this condition key to allow or deny access to all IAM users and roles in an AWS account in a single policy statement
Filters access to a symmetric AWS KMS key based on the encryption context in a cryptographic operation. This condition evaluates the key and value in each key-value encryption context pair
Filters access to a symmetric AWS KMS key based on the encryption context in a cryptographic operation. This condition key evaluates only the key in each key-value encryption context pair
Filters access to the CreateGrant operation based on the value of SourceArn constraint in the request
Filters access to the CreateGrant operation based on the grant constraint in the request
Filters access to the CreateGrant operation when the request comes from a specified AWS service
Filters access to the CreateGrant operation based on the operations in the grant
Filters access to the CreateGrant operation based on the grantee principal in the grant
Filters access to the CreateGrant operation based on the value of GranteeServicePrincipal in the request
Filters access to the CreateGrant operation based on the retiring principal in the grant
Filters access to the CreateGrant operation based on the value of RetiringServicePrincipal in the request
Filters access when a request made on the principal's behalf comes from a specified AWS service
Filters access to the specified AWS KMS operations based on tags assigned to the AWS KMS key
Filters access to an API operation based on the Origin property of the AWS KMS key created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key
Filters access to an API operation based on the KeySpec property of the AWS KMS key that is created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key resource
Filters access to an API operation based on the KeyUsage property of the AWS KMS key created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key resource
Filters access to an API operation based on the MultiRegion property of the AWS KMS key created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key resource
Filters access to an API operation based on the MultiRegionKeyType property of the AWS KMS key created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key resource
Filters access to specified AWS KMS operations based on aliases associated with the AWS KMS key
A minimal policy that allows kms:CreateGrant. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKmsCreateGrant",
"Effect": "Allow",
"Action": "kms:CreateGrant",
"Resource": "*"
}
]
}