Manage AWS KMS Access

Question

Being an AWS Administrator I want to avoid giving AWS KMS Access to developers. Is there a work around or some automated process that we can follow incase we don't want to give AWS KMS access to developers even if they are using KMS keys in there code.

Any suggestions or ideas are highly appreciated !!

Answer

Hi,

have a read at this: https://repost.aws/knowledge-center/share-kms-account.

The basic idea would be to get to order KMS keys from a central account managed by - let’s say - operations team and not accessible to developers.

This account will store keys and will contain KMS policies that would allow the team to use the key in their account, which can be changed by developers only by approval of ops team.

KMS keys will be shared across accounts so you can get their ARN and use it.

Hope it helps ;)

Manage AWS KMS Access

Relevant content