kms:ListKeys is a List access-level action in the kms service. Controls permission to view the key ID and Amazon Resource Name (ARN) of all AWS KMS keys in the account
This action does not support resource-level permissions; use "Resource": "*" in your policy.
Keys you can use in the Condition block of a policy that grants kms:ListKeys.
Filters access to specified AWS KMS operations based on the AWS account ID of the caller. You can use this condition key to allow or deny access to all IAM users and roles in an AWS account in a single policy statement
Filters access when a request made on the principal's behalf comes from a specified AWS service
A minimal policy that allows kms:ListKeys. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKmsListKeys",
"Effect": "Allow",
"Action": "kms:ListKeys",
"Resource": "*"
}
]
}