KMS Access Control

Access to KMS operations is controlled by policies and permissions.

Permission model

Key-level permissions

• kms:keys:create - Create new keys
• kms:keys:read - Read key metadata
• kms:keys:use - Use key for crypto operations
• kms:keys:rotate - Rotate key versions
• kms:keys:delete - Delete/destroy keys

Operation permissions

• kms:encrypt - Encrypt data
• kms:decrypt - Decrypt data
• kms:sign - Create signatures
• kms:verify - Verify signatures
• kms:wrap - Wrap keys
• kms:unwrap - Unwrap keys

Policy structure

{
	"version": "1",
	"statements": [
		{
			"effect": "allow",
			"actions": ["kms:encrypt", "kms:decrypt"],
			"resources": ["keys/storage-*"],
			"conditions": {
				"tenant": "${token.tenant_id}"
			}
		}
	]
}

Key policies

Each key can have an attached policy:

• Overrides default permissions
• Scoped to specific key
• Supports conditions

Conditions

Supported condition keys:

• tenant: Tenant ID match
• ip: Source IP range
• time: Time-based restrictions
• mfa: MFA requirement

Audit

All access decisions are logged:

• Requester identity
• Requested action
• Resource
• Decision (allow/deny)
• Timestamp