kms:CreateKey is a Write access-level action in the kms service. Controls permission to create an AWS KMS key that can be used to protect data keys and other sensitive information
This action does not support resource-level permissions; use "Resource": "*" in your policy.
No condition keys are documented for this action.
To use kms:CreateKey you may also need to grant:
A minimal policy that allows kms:CreateKey. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKmsCreateKey",
"Effect": "Allow",
"Action": "kms:CreateKey",
"Resource": "*"
}
]
}