cloudformation/templates/cfn.kms.yaml [15:39]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Enabled: true
      EnableKeyRotation: true
      KeyPolicy:
        Version: '2012-10-17'
        #The kms:ViaService condition key limits use of an AWS KMS customer master key (CMK) to requests from specified AWS services.
        #https://docs.aws.amazon.com/kms/latest/developerguide/policy-conditions.html#conditions-kms-via-service
        Statement:
          #Be sure that the key policy that you create allows the current user to administer the CMK.
          #https://aws.amazon.com/premiumsupport/knowledge-center/update-key-policy-future/
          #Error Message will be - The new key policy will not allow you to update the key policy in the future.
        - Sid: 'Allow administration of the key'
          Effect: 'Allow'
          Principal:
            AWS:
              - !Sub 'arn:aws:iam::${AWS::AccountId}:root'
              - !Sub 'arn:aws:iam::${AWS::AccountId}:role/${KeyAdministratorRole}'
          Action:
          - 'kms:Describe*'
          - 'kms:Get*'
          - 'kms:List*'
          - 'kms:Put*'
          - 'kms:RevokeGrant'
          - 'kms:Enable*'
          - 'kms:Delete*'
          - 'kms:CancelKeyDeletion'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



cloudformation/templates/cfn.kms.yaml [82:101]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Enabled: true
      EnableKeyRotation: true
      KeyPolicy:
        Version: '2012-10-17'
        Statement:
        - Sid: 'Allow administration of the key'
          Effect: 'Allow'
          Principal:
            AWS:
              - !Sub 'arn:aws:iam::${AWS::AccountId}:root'
              - !Sub 'arn:aws:iam::${AWS::AccountId}:role/${KeyAdministratorRole}'
          Action:
          - 'kms:Describe*'
          - 'kms:Get*'
          - 'kms:List*'
          - 'kms:Put*'
          - 'kms:RevokeGrant'
          - 'kms:Enable*'
          - 'kms:Delete*'
          - 'kms:CancelKeyDeletion'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



