# Default KMS Key Policy

* The **default key policy gives the AWS account (root user) that owns the CMK full access to the CMK**, which **accomplishes the following two things:**

### **Reduces the risk of the CMK becoming unmanageable.**

* You **cannot delete your AWS account's root user, so allowing access to this user reduces the risk of the CMK becoming unmanageable**.\\

* For example, **if a CMK's key policy allows only one IAM user, Alice, to manage the CMK and his key policy does not allow access to the root user**. Later, **someone deletes IAM user Alice**.\\

  * In this scenario, the **CMK is now unmanageable**, and you **must contact AWS Support to regain access to the CMK**.\\

    * The **root user does not have access to the CMK, because the root user can access a CMK only when the key policy explicitly allows it**. This is **different from most other resources in AWS, which implicitly allow access to the root user**.

### **Enables IAM policies to allow access to the CMK.**

* **IAM policies by themselves are not sufficient to allow access to a CMK**. However, you can **use them in combination with a CMK's key policy if the key policy enables it**.\\

* **Giving the AWS account full access to the CMK does this**; it enables you to **use IAM policies to give IAM users and roles in the account access to the CMK**.
