Using key policies with conditional keys

In this recipe, we will learn how to use key policies, especially with conditions. Resource-based policies for KMS keys are called key policies. When managing access to KMS resources, we can use key policies alone, or we can use IAM policies and grants along with key policies. Unlike other resource-based policies such as bucket policies, which are not mandatory, key policies are mandatory to manage and use keys. When a key is created, a default key policy is created by AWS, as we saw in the Creating keys in KMS recipe.

Getting ready

We’ll need the following to complete this recipe:

• A working AWS account, awsseccb-sandbox-1, and a user, awsseccbadmin1, as described in the Technical requirements section.
• An S3 bucket created in the us-east-1 region. I will use a bucket called awssecuritykmsbucket.

How to do it...

We can demonstrate the use of key policies with condition keys as follows:

1. Create a key with...