Default KMS Key Policy

• The default key policy gives the AWS account (root user) that owns the CMK full access to the CMK, which accomplishes the following two things:

Reduces the risk of the CMK becoming unmanageable.

• You cannot delete your AWS account's root user, so allowing access to this user reduces the risk of the CMK becoming unmanageable.

• For example, if a CMK's key policy allows only one IAM user, Alice, to manage the CMK and his key policy does not allow access to the root user. Later, someone deletes IAM user Alice.

  • In this scenario, the CMK is now unmanageable, and you must contact AWS Support to regain access to the CMK.

    • The root user does not have access to the CMK, because the root user can access a CMK only when the key policy explicitly allows it. This is different from most other resources in AWS, which implicitly allow access to the root user.

Enables IAM policies to allow access to the CMK.

• IAM policies by themselves are not sufficient to allow access to a CMK. However, you can use them in combination with a CMK's key policy if the key policy enables it.

• Giving the AWS account full access to the CMK does this; it enables you to use IAM policies to give IAM users and roles in the account access to the CMK.