key_policies

Creates, updates, deletes, gets or lists a key_policies resource.

Overview

Name	key_policies
Type	Resource
Id	aws.kms.key_policies

Fields

The following fields are returned by SELECT queries:

get_key_policy

Name	Datatype	Description
policy	string	A key policy document in JSON format. (pattern: <code>[\u0009\u000A\u000D\u0020-\u00FF]+</code>)
policy_name	string	The name of the key policy. The only valid value is default. (pattern: <code>[\w]+</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_key_policy	select	region		Gets a key policy attached to the specified KMS key. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:GetKeyPolicy (key policy) Related operations: PutKeyPolicy Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.
put_key_policy	replace	region, KeyId		Attaches a key policy to the specified KMS key. For more information about key policies, see Key Policies in the Key Management Service Developer Guide. For help writing and formatting a JSON policy document, see the IAM JSON Policy Reference in the Identity and Access Management User Guide . For examples of adding a key policy in multiple programming languages, see Use PutKeyPolicy with an Amazon Web Services SDK or CLI in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:PutKeyPolicy (key policy) Related operations: GetKeyPolicy Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.
list_key_policies	exec	region, KeyId		Gets the names of the key policies that are attached to a KMS key. This operation is designed to get policy names that you can use in a GetKeyPolicy operation. However, the only valid policy name is default. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:ListKeyPolicies (key policy) Related operations: GetKeyPolicy PutKeyPolicy Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

get_key_policy

Gets a key policy attached to the specified KMS key. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:GetKeyPolicy (key policy) Related operations: PutKeyPolicy Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.

SELECT
policy,
policy_name
FROM aws.kms.key_policies
WHERE region = '{{ region }}' -- required
;

REPLACE examples

put_key_policy

Attaches a key policy to the specified KMS key. For more information about key policies, see Key Policies in the Key Management Service Developer Guide. For help writing and formatting a JSON policy document, see the IAM JSON Policy Reference in the Identity and Access Management User Guide . For examples of adding a key policy in multiple programming languages, see Use PutKeyPolicy with an Amazon Web Services SDK or CLI in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:PutKeyPolicy (key policy) Related operations: GetKeyPolicy Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.

REPLACE aws.kms.key_policies
SET 
KeyId = '{{ KeyId }}',
PolicyName = '{{ PolicyName }}',
Policy = '{{ Policy }}',
BypassPolicyLockoutSafetyCheck = {{ BypassPolicyLockoutSafetyCheck }}
WHERE 
region = '{{ region }}' --required
AND KeyId = '{{ KeyId }}' --required;

Lifecycle Methods

list_key_policies

Gets the names of the key policies that are attached to a KMS key. This operation is designed to get policy names that you can use in a GetKeyPolicy operation. However, the only valid policy name is default. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:ListKeyPolicies (key policy) Related operations: GetKeyPolicy PutKeyPolicy Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.

EXEC aws.kms.key_policies.list_key_policies 
@region='{{ region }}' --required 
@@json=
'{
"KeyId": "{{ KeyId }}", 
"Limit": {{ Limit }}, 
"Marker": "{{ Marker }}"
}'
;