Amazon KMS Kms Key Policy API
The Kms Key Policy API from Amazon KMS — 3 operation(s) for kms key policy.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/amazon-kms:amazon-kms-key-policy-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: AWS Key Management Service Key Policy API
version: '2014-11-01'
description: Generated from AWS's published Smithy model for AWS Key Management Service. 3 operation(s).
contact:
name: Amazon Web Services
url: https://aws.amazon.com/contact-us/
license:
name: Apache 2.0
identifier: Apache-2.0
url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://kms.{region}.amazonaws.com
variables:
region:
default: us-east-1
security:
- sigv4: []
tags:
- name: Key Policy
paths:
/#GetKeyPolicy:
post:
operationId: GetKeyPolicy
summary: Get Key Policy
description: 'Gets a key policy attached to the specified KMS key. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:GetKeyPolicy (key policy) Related operations: PutKeyPolicy Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.'
responses:
'200':
description: Success
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/GetKeyPolicyResponse'
example:
Policy: "{\n \"Version\" : \"2012-10-17\",\n \"Id\" : \"key-default-1\",\n \"Statement\" : [ {\n \"Sid\" : \"Enable IAM User Permissions\",\n \"Effect\" : \"Allow\",\n \"Principal\" : {\n \"AWS\" : \"arn:aws:iam::111122223333:root\"\n },\n \"Action\" : \"kms:*\",\n \"Resource\" : \"*\"\n } ]\n}"
'503':
description: DependencyTimeoutException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/DependencyTimeoutException'
'400':
description: InvalidArnException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/InvalidArnException'
'500':
description: KMSInternalException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/KMSInternalException'
'409':
description: KMSInvalidStateException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/KMSInvalidStateException'
'404':
description: NotFoundException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/NotFoundException'
parameters:
- name: X-Amz-Target
in: header
required: true
schema:
type: string
enum:
- TrentService.GetKeyPolicy
requestBody:
required: true
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/GetKeyPolicyRequest'
example:
KeyId: 1234abcd-12ab-34cd-56ef-1234567890ab
PolicyName: default
tags:
- Key Policy
/#ListKeyPolicies:
post:
operationId: ListKeyPolicies
summary: List Key Policies
description: 'Gets the names of the key policies that are attached to a KMS key. This operation is designed to get policy names that you can use in a GetKeyPolicy operation. However, the only valid policy name is default. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:ListKeyPolicies (key policy) Related operations: GetKeyPolicy PutKeyPolicy Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.'
responses:
'200':
description: Success
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/ListKeyPoliciesResponse'
example:
PolicyNames:
- default
Truncated: false
'503':
description: DependencyTimeoutException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/DependencyTimeoutException'
'400':
description: InvalidArnException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/InvalidArnException'
'500':
description: KMSInternalException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/KMSInternalException'
'409':
description: KMSInvalidStateException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/KMSInvalidStateException'
'404':
description: NotFoundException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/NotFoundException'
parameters:
- name: X-Amz-Target
in: header
required: true
schema:
type: string
enum:
- TrentService.ListKeyPolicies
requestBody:
required: true
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/ListKeyPoliciesRequest'
example:
KeyId: 1234abcd-12ab-34cd-56ef-1234567890ab
tags:
- Key Policy
/#PutKeyPolicy:
post:
operationId: PutKeyPolicy
summary: Put Key Policy
description: 'Attaches a key policy to the specified KMS key. For more information about key policies, see Key Policies in the Key Management Service Developer Guide. For help writing and formatting a JSON policy document, see the IAM JSON Policy Reference in the Identity and Access Management User Guide . For examples of adding a key policy in multiple programming languages, see Use PutKeyPolicy with an Amazon Web Services SDK or CLI in the Key Management Service Developer Guide. Cross-account use: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account. Required permissions: kms:PutKeyPolicy (key policy) Related operations: GetKeyPolicy Eventual consistency: The KMS API follows an eventual consistency model. For more information, see KMS eventual consistency.'
responses:
'200':
description: Success
content:
application/x-amz-json-1.1:
schema:
type: string
'503':
description: DependencyTimeoutException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/DependencyTimeoutException'
'400':
description: InvalidArnException; LimitExceededException; MalformedPolicyDocumentException; UnsupportedOperationException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/InvalidArnException'
'500':
description: KMSInternalException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/KMSInternalException'
'409':
description: KMSInvalidStateException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/KMSInvalidStateException'
'404':
description: NotFoundException
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/NotFoundException'
parameters:
- name: X-Amz-Target
in: header
required: true
schema:
type: string
enum:
- TrentService.PutKeyPolicy
requestBody:
required: true
content:
application/x-amz-json-1.1:
schema:
$ref: '#/components/schemas/PutKeyPolicyRequest'
example:
KeyId: 1234abcd-12ab-34cd-56ef-1234567890ab
PolicyName: default
Policy: "{\n \"Version\": \"2012-10-17\",\n \"Id\": \"custom-policy-2016-12-07\",\n \"Statement\": [\n {\n \"Sid\": \"Enable IAM User Permissions\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111122223333:root\"\n },\n \"Action\": \"kms:*\",\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow access for Key Administrators\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": [\n \"arn:aws:iam::111122223333:user/ExampleAdminUser\",\n \"arn:aws:iam::111122223333:role/ExampleAdminRole\"\n ]\n },\n \"Action\": [\n \"kms:Create*\",\n \"kms:Describe*\",\n \"kms:Enable*\",\n \"kms:List*\",\n \"kms:Put*\",\n \"kms:Update*\",\n \"kms:Revoke*\",\n \"kms:Disable*\",\n \"kms:Get*\",\n \"kms:Delete*\",\n \"kms:ScheduleKeyDeletion\",\n \"kms:CancelKeyDeletion\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow use of the key\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111122223333:role/ExamplePowerUserRole\"\n },\n \"Action\": [\n \"kms:Encrypt\",\n \"kms:Decrypt\",\n \"kms:ReEncrypt*\",\n \"kms:GenerateDataKey*\",\n \"kms:DescribeKey\"\n ],\n \"Resource\": \"*\"\n },\n {\n \"Sid\": \"Allow attachment of persistent resources\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::111122223333:role/ExamplePowerUserRole\"\n },\n \"Action\": [\n \"kms:CreateGrant\",\n \"kms:ListGrants\",\n \"kms:RevokeGrant\"\n ],\n \"Resource\": \"*\",\n \"Condition\": {\n \"Bool\": {\n \"kms:GrantIsForAWSResource\": \"true\"\n }\n }\n }\n ]\n}\n"
tags:
- Key Policy
components:
schemas:
ListKeyPoliciesRequest:
type: object
properties:
KeyId:
type: string
description: 'Gets the names of key policies for the specified KMS key. Specify the key ID or key ARN of the KMS key. For example: Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.'
Limit:
type: integer
description: Use this parameter to specify the maximum number of items to return. When this value is present, KMS does not return more than the specified number of items, but it might return fewer. This value is optional. If you include a value, it must be between 1 and 1000, inclusive. If you do not include a value, it defaults to 100. Only one policy can be attached to a key.
Marker:
type: string
description: Use this parameter in a subsequent request after you receive a response with truncated results. Set it to the value of NextMarker from the truncated response you just received.
required:
- KeyId
PutKeyPolicyRequest:
type: object
properties:
KeyId:
type: string
description: 'Sets the key policy on the specified KMS key. Specify the key ID or key ARN of the KMS key. For example: Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.'
PolicyName:
type: string
description: The name of the key policy. If no policy name is specified, the default value is default. The only valid value is default.
Policy:
type: string
description: 'The key policy to attach to the KMS key. The key policy must meet the following criteria: The key policy must allow the calling principal to make a subsequent PutKeyPolicy request on the KMS key. This reduces the risk that the KMS key becomes unmanageable. For more information, see Default key policy in the Key Management Service Developer Guide. (To omit this condition, set BypassPolicyLockoutSafetyCheck to true.) Each statement in the key policy must contain one or more principals. The principals in the key policy must exist and be visible to KMS. When you create a new Amazon Web Services pr'
BypassPolicyLockoutSafetyCheck:
type: boolean
description: Skips ("bypasses") the key policy lockout safety check. The default value is false. Setting this value to true increases the risk that the KMS key becomes unmanageable. Do not set this value to true indiscriminately. For more information, see Default key policy in the Key Management Service Developer Guide. Use this parameter only when you intend to prevent the principal that is making the request from making a subsequent PutKeyPolicy request on the KMS key.
required:
- KeyId
- Policy
ListKeyPoliciesResponse:
type: object
properties:
PolicyNames:
type: array
items:
type: string
description: A list of key policy names. The only valid value is default.
NextMarker:
type: string
description: When Truncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent request.
Truncated:
type: boolean
description: A flag that indicates whether there are more items in the list. When this value is true, the list in this response is truncated. To get more items, pass the value of the NextMarker element in this response to the Marker parameter in a subsequent request.
GetKeyPolicyResponse:
type: object
properties:
Policy:
type: string
description: A key policy document in JSON format.
PolicyName:
type: string
description: The name of the key policy. The only valid value is default.
NotFoundException:
type: object
properties:
message:
type: string
GetKeyPolicyRequest:
type: object
properties:
KeyId:
type: string
description: 'Gets the key policy for the specified KMS key. Specify the key ID or key ARN of the KMS key. For example: Key ID: 1234abcd-12ab-34cd-56ef-1234567890ab Key ARN: arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab To get the key ID and key ARN for a KMS key, use ListKeys or DescribeKey.'
PolicyName:
type: string
description: Specifies the name of the key policy. If no policy name is specified, the default value is default. The only valid name is default. To get the names of key policies, use ListKeyPolicies.
required:
- KeyId
KMSInvalidStateException:
type: object
properties:
message:
type: string
KMSInternalException:
type: object
properties:
message:
type: string
DependencyTimeoutException:
type: object
properties:
message:
type: string
InvalidArnException:
type: object
properties:
message:
type: string
securitySchemes:
sigv4:
type: apiKey
in: header
name: Authorization
description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
x-aws-sigv4:
signingName: kms
x-provenance:
method: harvested
publisher: Amazon Web Services
source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/kms/service/2014-11-01/kms-2014-11-01.json
note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)