Feb 01, 2022

Allow Principals to Encrypt via KMS but Deny Decrypt via KMS

Amazon Web Services AWS KMS
0
0
Daniel Popescu
Daniel PopescuGroup Technical Lead - Security
{{ }} Substitute variables

Adjust the variable values according to your preference.

Policy Code

1{
2  "Statement": [
3    {
4      "Sid": "DenyDecrypt",
5      "Effect": "Deny",
6      "Action": "kms:Decrypt",
7      "Resource": "*"
8    },
9    {
10      "Sid": "AllowEncrypt",
11      "Effect": "Allow",
12      "Action": "kms:Encrypt",
13      "Resource": "*"
14    }
15  ],
16  "Version": "2012-10-17"
17}

    Get the IAM Pulse Check Newsletter

    We send out a periodic newsletter full of tips & tricks, contributions from the community, commentary on the industry, relevant social posts, and more.

    Checkout past issues for a sampling of the goods.