Ravi Sir's Cards › AWS
Bucket vs KMS key policy
This revision card explains Bucket vs KMS key policy. It starts from the need that s3 allow is not enough — KMS must allow Encrypt/Decrypt for the caller. It describes grant roles on key; watch cross-account grants; schedule deletions carefully. The how-to section covers how to put with wrong key id fails; correct key succeeds. An example on the card is fatima Khan adds Decrypt for the reader role on the CMK.
Read card text
What this card says
Why do we need it?
S3 allow is not enough — KMS must allow Encrypt/Decrypt for the caller.
key policy
What is it?
Grant roles on key; watch cross-account grants; schedule deletions carefully.
How to do it
Put with wrong key id fails; correct key succeeds.
Example
Fatima Khan adds Decrypt for the reader role on the CMK.