aws kms get-key-policy

Gets a key policy attached to the specified KMS key. AWS CLI reference

1 example 2 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To copy a key policy from one KMS key to another KMS key

The following get-key-policy example gets the key policy from one KMS key and saves it in a text file. Then, it replaces the policy of a different KMS key using the text file as the policy input.

Because the --policy parameter of put-key-policy requires a string, you must use the --output text option to return the output as a text string instead of JSON.

aws kms get-key-policy --policy-name default --key-id a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 --query Policy --output text > policy.txt

Identify

--policy-nameSpecifies the name of the key policy.

--key-idGets the key policy for the specified KMS key.

--queryA JMESPath query to use in filtering the response data.

--outputThe formatting style for command output.

The following put-key-policy example uses the policy.txt file to replace the key policy of the other KMS key.

aws kms put-key-policy --policy-name default --key-id a1b2c3d4-5678-90ab-cdef-EXAMPLE22222 --policy file://policy.txtIdentify

--policy-nameThe name of the key policy.

--key-idSets the key policy on the specified KMS key.

--policyThe key policy to attach to the KMS key.

Contents of policy.txt:

{
    "Version": "2012-10-17",
    "Id": "key-default-1",
    "Statement": [
        {
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        }
    ]
}

This command produces no output.

For more information, see Key policies in AWS KMS in the AWS Key Management Service Developer Guide.

Options

2 in the AWS CLI reference

--key-idGets the key policy for the specified KMS key.

--policy-nameSpecifies the name of the key policy.