> For the complete documentation index, see [llms.txt](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/kms-grantisforawsresource.md).

# kms:GrantIsForAWSResource

* **Allows or denies permission** for the `CreateGrant`, `ListGrants`, or `RevokeGrant` operations **only when an AWS services integrated with KMS calls the operation on the user's behalf**.<br>

* This policy condition **doesn't allow the user to call these grant operations directly**.

* The **following example key policy statement uses the `kms:GrantIsForAWSResource` condition key**.
  * It **allows AWS services that are integrated with KMS, such as EBS, to create grants on this CMK on behalf of the specified user**.

```
{
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::111122223333:user/ExampleUser"
  },
  "Action": "kms:CreateGrant",
  "Resource": "*",
  "Condition": {
    "Bool": {
      "kms:GrantIsForAWSResource": true
    }
  }
}
```