A key policy is a resource-based policy that controls which Alibaba Cloud accounts, RAM (Resource Access Management) users, and RAM roles can manage or use a KMS key. Each key in a KMS instance must have exactly one key policy. This topic describes key policies in detail.
Relationship between key policies and RAM policies
A key policy lets you designate RAM users and RAM roles within the current Alibaba Cloud account (the account that owns the key) as administrators or key users. You can also designate RAM users and RAM roles from other Alibaba Cloud accounts as key users.
In addition to configuring a key policy in KMS, you can configure identity-based policies in RAM to specify which Alibaba Cloud accounts, RAM users, or RAM roles can manage or use specific keys. For more information, see Manage RAM user permissions, Manage permissions for a RAM role, and Custom policies.
When an Alibaba Cloud account or a RAM identity (RAM user or RAM role) requests access to KMS resources through the Alibaba Cloud console, OpenAPI, or CLI, the system evaluates applicable policies to determine whether to allow or deny the request. The following flowchart shows the evaluation process.
The evaluation result follows these principles:
For a RAM user or RAM role under the current Alibaba Cloud account: access is granted if either evaluation result A or evaluation result B contains an Allow and no Explicit Deny.
NoteThe current Alibaba Cloud account is the account that created the key. You can view the key creator by using one of the following methods:
Console: Log on to the KMS console. On the Keys page, open the key details page and view the Created By field.
API: Call the DescribeKey operation. The
Creatorfield in the response indicates the key creator.
For more information about Explicit Deny and Implicit Deny, see Policy evaluation logic.
For a RAM user or RAM role under a different Alibaba Cloud account: access is granted only when both evaluation result A and evaluation result B are Allow.
Based on the evaluation process, you can determine the required configuration for different scenarios:
To allow a RAM user or RAM role under the current Alibaba Cloud account to manage or use a key, configure either the key policy in KMS or a RAM policy to grant the required permissions.
To allow a RAM user or RAM role under a different Alibaba Cloud account to use a key, you must configure both the key policy in KMS and a RAM policy to grant permissions.
Usage notes
Key policies apply only to keys within a KMS instance. You can configure a key policy during key creation or modify it afterward. For more information, see Create a key and Configure a key policy.
Authorizing RAM users or roles from other Alibaba Cloud accounts consumes the Accounts in Use quota of the KMS instance. The quota is calculated based on the number of Alibaba Cloud accounts. If you revoke cross-account authorization and the instance no longer shares resources with that account, wait approximately 5 minutes for the quota to be returned.
A key policy only applies to access control when you access a key through the KMS service endpoint. If you access a key through a KMS instance endpoint, access depends on the permission policy configured in the Application Access Point (AAP).
A key policy must be in JSON format and cannot exceed 32,768 bytes in size.
Key policy structure
A complete key policy contains the following elements:
Version: The version of the key policy. Only version 1 is supported.
Statement: A key policy contains one or more statements. Each statement includes the following parameters:
Sid
Optional. A custom statement identifier. The identifier can be up to 128 characters in length and can contain uppercase letters (A-Z), lowercase letters (a-z), digits (0-9), and the following special characters: _ / + = . @ -
Effect
Required. Specifies whether to allow or deny the actions in the statement. Valid values:
AllowandDeny.Principal
Required. The identity to which the policy applies. You can specify one of the following:
The current Alibaba Cloud account (the account that owns the key).
RAM users or RAM roles under the current Alibaba Cloud account.
RAM users or RAM roles under a different Alibaba Cloud account.
ImportantAfter you authorize RAM users or roles from another Alibaba Cloud account, you must also use the Alibaba Cloud account that manages those RAM identities to grant them permission to use the key in RAM. Otherwise, the RAM identities cannot use the key.
For more information, see Custom policies, Manage RAM user permissions, and Manage permissions for a RAM role.
Action
Required. The API operations to allow or deny. The value must start with "kms:". Only the following operations are valid. Operations outside this list will not take effect.
Resource
Required. The target resource to which the policy applies. Set the value to
*or the ARN of the key. A value of*indicates the current KMS key. You can also specify a specific key ARN to narrow the policy scope.Condition
Optional. The conditions under which the policy takes effect. A condition element, also called a condition block, consists of one or more condition clauses. Each clause contains a condition operator, a condition key, and a condition value. For more information, see Permission policy elements.
The format is
"Condition": {"condition operator": {"condition key": "condition value"}}.condition operator: For more information, see Condition operator types.condition keyandcondition value: For the condition keys and valid values supported by key policies, see Policy condition keys.