kms:UpdateCustomKeyStore is a Write access-level action in the kms service. Controls permission to change the properties of a custom key store
This action does not support resource-level permissions; use "Resource": "*" in your policy.
Keys you can use in the Condition block of a policy that grants kms:UpdateCustomKeyStore.
Filters access to specified AWS KMS operations based on the AWS account ID of the caller. You can use this condition key to allow or deny access to all IAM users and roles in an AWS account in a single policy statement
A minimal policy that allows kms:UpdateCustomKeyStore. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKmsUpdateCustomKeyStore",
"Effect": "Allow",
"Action": "kms:UpdateCustomKeyStore",
"Resource": "*"
}
]
}