kms:ListKeys is a List access-level action in the kms service. Controls permission to view the key ID and Amazon Resource Name (ARN) of all AWS KMS keys in the account
This action does not support resource-level permissions; use "Resource": "*" in your policy.
No condition keys are documented for this action.
A minimal policy that allows kms:ListKeys. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKmsListKeys",
"Effect": "Allow",
"Action": "kms:ListKeys",
"Resource": "*"
}
]
}