1 Antwort
- Neueste
- Die meisten Stimmen
- Die meisten Kommentare
1
The following example IAM policy statement allows the principal to enable and disable KMS keys but only when all aliases of the KMS keys include "Test." This policy statement uses two conditions. The condition with the ForAllValues set operator requires that all aliases associated with the KMS key include "Test". The condition with the ForAnyValue set operator requires that the KMS key have at least one alias with "Test." Without the ForAnyValue condition, this policy statement would have allowed the principal to use KMS keys that had no aliases.
{
"Sid": "AliasBasedIAMPolicy",
"Effect": "Allow",
"Action": [
"kms:EnableKey",
"kms:DisableKey"
],
"Resource": "arn:aws:kms:*:111122223333:key/*",
"Condition": {
"ForAllValues:StringLike": {
"kms:ResourceAliases": [
"alias/*Test*"
]
},
"ForAnyValue:StringLike": {
"kms:ResourceAliases": [
"alias/*Test*"
]
}
}
}
beantwortet vor 2 Jahren
Relevanter Inhalt
- AWS OFFICIALAktualisiert vor einem Monat
- AWS OFFICIALAktualisiert vor 9 Monaten