kms:ListAliases is a List access-level action in the kms service. Controls permission to view the aliases that are defined in the account. Aliases are optional friendly names that you can associate with AWS KMS keys
This action does not support resource-level permissions; use "Resource": "*" in your policy.
Keys you can use in the Condition block of a policy that grants kms:ListAliases.
Filters access to specified AWS KMS operations based on the AWS account ID of the caller. You can use this condition key to allow or deny access to all IAM users and roles in an AWS account in a single policy statement
Filters access when a request made on the principal's behalf comes from a specified AWS service
A minimal policy that allows kms:ListAliases. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKmsListAliases",
"Effect": "Allow",
"Action": "kms:ListAliases",
"Resource": "*"
}
]
}