Set a key policy for a KMS key using the Key Management Service (KMS) console or OpenAPI - Key Management Service

Configure a key policy in the KMS console

Log on to the Key Management Service console. In the top navigation bar, select a region. In the left-side navigation pane, choose Resource > Keys.
On the Customer Master Keys tab, find the key you want to configure. Click the key ID or Details in the Actions column.
On the details page, scroll to the Key Policy section and click Configure Key Policy. Configure the key policy and click OK.
1. Visual Editor: Assign a Principal (a RAM user or RAM role) to a predefined role with default permissions (Actions).
  - Administrator: Principals assigned to this role can manage the key but cannot perform cryptographic operations. Assign this role to RAM users and RAM roles within your Alibaba Cloud account.
  - User: Principals assigned to this role can only use the key for cryptographic operations. Assign this role to RAM users and RAM roles within your Alibaba Cloud account.
  - Cross-account User:
    Important
    
    Granting permissions to a RAM user or RAM role from another Alibaba Cloud account consumes the Access Management Quota of your KMS instance. Quota consumption is based on the number of unique Alibaba Cloud accounts you grant access to. If you revoke the authorization, the quota is released after approximately five minutes.
    
    To allow the cross-account principal to use the key, you must also grant the required permissions to the corresponding RAM user or RAM role in the RAM console of the target account. For more information, see Custom Permission Policies for Key Management Service, Manage permissions for a RAM User, and Manage permissions for a RAM Role.
    - This can be a RAM user or RAM role from another Alibaba Cloud account. Cross-account users can only use the key for cryptographic operations.
    - Click Add ARN of Cross-account User and enter the ARN of the principal. You can find the ARN on the user or role details page in the RAM console.
      - RAM user: Format is acs:ram::<Other Alibaba Cloud Account ID>:user/<ramuser>. Example: acs:ram::119285303511****:user/testpolicyuser.
      - RAM role: Format is acs:ram::<Other Alibaba Cloud Account ID>:role/<ramrole>. Example: acs:ram::119285303511****:role/testpolicyrole.
2. Syntax Editor: Directly modify or add permission statements in the policy editor. The following example shows a sample configuration.
  - Scenario: This example shows a key policy for a key that belongs to Alibaba Cloud account 119285303511****.
    - The key owner (Alibaba Cloud account 119285303511****) has full access to manage and use the key. Do not change this default statement.
      
      Note
      The key owner has all permissions by default. This rule cannot be modified.
    - This statement allows RAM user key_ramuser1 in the same account (119285303511****) to manage the key.
    - This statement allows RAM user key_ramuser2 in the same account (119285303511****) and RAM user key_ramuser3 from another account (190325303126****) to use the key.
  - Policy example:
```
{
    "Statement": [
        {
            "Action": [
                "kms:*"
            ],
            "Effect": "Allow",
            "Principal": {
                "RAM": [
                    "acs:ram::119285303511****:*"
                ]
            },
            "Resource": [
                "*"
            ],
            "Sid": "kms default key policy"
        },
        {
            "Action": [
                "kms:List*",
                "kms:Describe*",
                "kms:Create*",
                "kms:Enable*",
                "kms:Disable*",
                "kms:Get*",
                "kms:Set*",
                "kms:Update*",
                "kms:Delete*",
                "kms:Cancel*",
                "kms:TagResource",
                "kms:UntagResource",
                "kms:ImportKeyMaterial",
                "kms:ScheduleKeyDeletion"
            ],
            "Effect": "Allow",
            "Principal": {
                "RAM": [
                    "acs:ram::119285303511****:user/key_ramuser1"
                ]
            },
            "Resource": [
                "*"
            ]
        },
        {
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:GenerateDataKey",
                "kms:GenerateAndExportDataKey",
                "kms:AsymmetricEncrypt",
                "kms:AsymmetricDecrypt",
                "kms:DescribeKey",
                "kms:DescribeKeyVersion",
                "kms:ListKeyVersions",
                "kms:ListAliasesByKeyId",
                "kms:TagResource"
            ],
            "Effect": "Allow",
            "Principal": {
                "RAM": [
                    "acs:ram::119285303511****:user/key_ramuser2",
                    "acs:ram::190325303126****:user/key_ramuser3"
                ]
            },
            "Resource": [
                "*"
            ]
        }
    ],
    "Version": "1"
}
```

Limitations

A key policy can be applied only to a Customer Master Keys.
A key policy must be in JSON format and cannot exceed 32,768 bytes in size.

You can specify the following actions in a key policy:

Warning

If you specify an action that is not in this list, the permission does not take effect.

 "Action": [
                "kms:List*",
                "kms:Describe*",
                "kms:Create*",
                "kms:Enable*",
                "kms:Disable*",
                "kms:Get*",
                "kms:Set*",
                "kms:Update*",
                "kms:Delete*",
                "kms:Cancel*",
                "kms:TagResource",
                "kms:UntagResource",
                "kms:ImportKeyMaterial",
                "kms:ScheduleKeyDeletion",
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:GenerateDataKey",
                "kms:GenerateAndExportDataKey",
                "kms:AsymmetricEncrypt",
                "kms:AsymmetricDecrypt",
                "kms:DescribeKey",
                "kms:DescribeKeyVersion",
                "kms:ListKeyVersions",
                "kms:ListAliasesByKeyId",
                "kms:TagResource"
            ]

Cross-account key authorization: To authorize a cross-account RAM user or RAM role to use a key, you must configure permissions in both accounts:
1. In the KMS console, add a policy statement for a Cross-account User to grant usage permissions to the target account.
2. In the target account, configure a permission policy in the RAM console to grant the corresponding RAM user or RAM role permission to use the key.

Default permissions (Actions)

Administrator

Principals assigned to this role can manage the key but cannot perform cryptographic operations.

  "Action": [
                "kms:List*",
                "kms:Describe*",
                "kms:Create*",
                "kms:Enable*",
                "kms:Disable*",
                "kms:Get*",
                "kms:Set*",
                "kms:Update*",
                "kms:Delete*",
                "kms:Cancel*",
                "kms:TagResource",
                "kms:UntagResource",
                "kms:ImportKeyMaterial",
                "kms:ScheduleKeyDeletion"
            ]

User/cross-account user

Principals assigned to this role can use the key only for cryptographic operations.

 "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:GenerateDataKey",
                "kms:GenerateAndExportDataKey",
                "kms:AsymmetricEncrypt",
                "kms:AsymmetricDecrypt",
                "kms:DescribeKey",
                "kms:DescribeKeyVersion",
                "kms:ListKeyVersions",
                "kms:ListAliasesByKeyId",
                "kms:TagResource"
            ]