Granting permissions programmatically with grants

KMS grants can be used to give temporary granular permissions to AWS KMS API operations such as encrypting, decrypting, and describing keys, and more. We can use grants to provide access to a user in their account or even another account. In this recipe, we will grant access to a user so that they can encrypt and decrypt files using AWS KMS.

Getting ready

We’ll need the following to complete this recipe:

• A working AWS account with two users: a user with AdministratorAccess permission and a user with no permissions. The CLI profiles should be configured for these users. I will be calling these users and their CLI profiles Adminuserprofile and testusernopermission, respectively, following the recipes in Chapter 1.
• A KMS key. We can create one by following previous recipes in this chapter. Alternatively, use the following command to create a KMS key from the AWS CLI:

  aws kms create-key --profile Adminuserprofile...