‫So now let's talk about KMS Key Policies
‫and I wanna give you a few examples.
‫So we know that a Key Policy is used to define
‫who has access to your KMS Key.
‫And the default KMS Key Policy that you create
‫through the AWS Console allows anyone within your account
‫to access your KMS Key,
‫as long as they have the proper IAM permissions.
‫So this is a special one.
‫And if you wanted to explicitly authorize a specific user,
‫it could be whatever user, it could be a user,
‫an IAM role, it could be a federated user, for example,
‫as you can see in this example on the right-hand side.
‫You could, for example, allow which KMS actions you want,
‫such as encrypt, decrypt, et cetera, et cetera.
‫And then you explicitly outline the principle.
‫In that case, the federated user
‫in this example, does not need, additionally,
‫an extra IAM policy to use your KMS key
‫because it's been explicitly allowed in the KMS key policy.
‫So what kind of principles can we explicitly allow
‫in KMS key policies, but also in anything IAM?
‫Well, we have the account and the root user.
‫So when you define something like this,
‫such as principle AWS and the new account number,
‫or the account number, and then route,
‫you allow every principle within the accounts, okay?
‫And then IAM policies kick in.
‫Next, you can authorize a specific IAM role
‫by outlining the role arn directly
‫in the principle statements.
‫You have IAM role sessions,
‫so this is when you have an assumed role,
‫or when you have an assumed identity through Federation.
‫For example, for Cognito identity or SAML.
‫You also have AIM users when you outline a specific user
‫in your accounts, or of course, in other accounts.
‫You have federated user sessions.
‫This is what we've seen before.
‫So when you have user federation in AWS,
‫you can specify a specific federated user,
‫and then you can also allow a specific service.
‫So you can see the principle now
‫has a service to allow specific services
‫to use your KMS key.
‫Or if you wanted to allow everything and everyone,
‫you can just use a Star or AWS star.
‫Okay, so let's see for this lecture.
‫I hope you liked it and I will see you in the next lecture.