GetKeyPolicy - Key Management Service - Alibaba Cloud Documentation Center

Operation description

For more information about the access policy required for a Resource Access Management (RAM) user or RAM role to call this operation, see Resource Access Management.
Because the key policy name can only be set to default, you must set the PolicyName parameter to default when you query the key policy. Otherwise, a Not Found error is returned.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

No authorization for this operation. If you encounter issues with this operation, contact technical support.

Request parameters

Parameter	Type	Required	Description	Example
KeyId	string	Yes	The ID or Alibaba Cloud Resource Name (ARN) of the key. Note When you access a key in another Alibaba Cloud account, you must enter the ARN of the key. The ARN of a key is in the `acs:kms:${region}:${account}:key/${keyid}` format.	key-hzz630494463ejqjx****
PolicyName	string	No	The name of the key policy. Only the static value default is supported.	default

Response elements

Parameter	Type	Description	Example
	object
RequestId	string	The ID of the request. This ID is a unique identifier generated by Alibaba Cloud for the request. You can use this ID to troubleshoot issues.	381D5D33-BB8F-395F-8EE4-AE3B84B523C8
Policy	string	The key policy.	{"Statement": [{"Action": ["kms:"],"Effect": "Allow","Principal": {"RAM": ["acs:ram::190325303126**:","acs:ram::119285303511***:"]},"Resource": ["*"],"Sid": "kms default key policy"}],"Version": "1" }

Examples

Success response

JSON format

{
  "RequestId": "381D5D33-BB8F-395F-8EE4-AE3B84B523C8",
  "Policy": "{\"Statement\": [{\"Action\": [\"kms:*\"],\"Effect\": \"Allow\",\"Principal\": {\"RAM\": [\"acs:ram::190325303126****:*\",\"acs:ram::119285303511****:*\"]},\"Resource\": [\"*\"],\"Sid\": \"kms default key policy\"}],\"Version\": \"1\" }"
}

Error codes

HTTP status code	Error code	Error message	Description
400	InvalidParameter	The specified parameter is not valid.	An invalid value is specified for the parameter.
400	MissingParameter	The parameter needed but no provided.	The required parameters are not specified.
400	Forbidden.NoPermission	This operation is forbidden by permission system.	You are not authorized to perform this operation.
400	Forbidden.KeyPolicyUnSupported	The specified key does not support key policy.	The specified key does not support key policies.
404	Forbidden.KeyNotFound	The specified Key is not found.	The error message returned because the specified CMK does not exist.
404	Forbidden.ResourceNotFound	Policy not found.

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.