@planetarium/account-aws-kms

An npm package for providing AwsKmsKeyStore, an implementation of KeyStore from @planetarium/account that uses AWS KMS as the backend.

Required permissions

| Method | Required permissions | Required for AwsKmsKeyStoreOptions.scopingTags | |-----------------------------|-------------------------------------|--------------------------------------------------| | AwsKmsKeyStore.list() | kms:ListKeys | kms:ListResourceTags | | AwsKmsKeyStore.get() | kms:ListKeys | kms:ListResourceTags | | AwsKmsKeyStore.generate() | kms:CreateKey, kms:GetPublicKey | kms:TagResource | | AwsKmsKeyStore.delete() | kms:ScheduleKeyDeletion | | | AwsKmsAccount.sign()[^1] | kms:Sign | |

Replace [NUMERIC_ROOT_ACCOUNT_ID] with your [12-digit root account ID][AWSId]:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kms:GetPublicKey",
        "kms:ScheduleKeyDeletion",
        "kms:DescribeKey",
        "kms:ListResourceTags",
        "kms:Sign",
        "kms:TagResource"
      ],
      "Resource": "arn:aws:kms:*:[NUMERIC_ROOT_ACCOUNT_ID]:key/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:ListKeys",
        "kms:CreateKey"
      ],
      "Resource": "*"
    }
  ]
}

[^1]: An AwsKmsAccount instance can be obtained from AwsKmsKeyStore.get(). [AWSId]: https://docs.aws.amazon.com/signin/latest/userguide/FindingYourAWSId.html