# Managing access to KMS CMKs

* The **primary way to manage access to your AWS KMS CMKs is with policies**.\\

* **Policies attached to an IAM identity are called identity-based policies** (or IAM policies).\\

* **Policies attached to other kinds of resources are called resource-based policies**.\\

* **In KMS, you must attach resource-based policies to your CMKs (called key policies)** and all KMS CMKs have a key policy.

* You can **control access to your KMS CMKs in these ways:**\\

  * **Use the key policy** - You **must use the key policy to control access to a CMK**. You **can use the key policy alone** to control access.\\

  * **Use IAM policies in combination with the key policy** - Controlling access this way **enables you to manage all of the permissions for your IAM identities in IAM**.\\

  * **Use grants in combination with the key policy** - Controlling access this way **enables you to allow access to the CMK in the key policy, and to allow users to delegate their access to others**.

* **IAM policies by themselves are not sufficient to allow access to a CMK, though you can use them in combination with a CMK's key policy**.
