- Newest
- Most votes
- Most comments
When referring to a KMS key alias in your CloudFormation code for encryption or decryption operations, you should use the full alias name, including the "alias/" prefix.
In your specific case, the correct way to refer to the alias in the condition would be:
Condition:
StringLike:
kms:RequestAlias: alias/name_of_the_alias
The "alias/" prefix is a required part of the alias name in AWS KMS. This prefix distinguishes aliases from other types of identifiers and is consistent with how aliases are defined and used across AWS KMS services.
It's important to note that when using the kms:RequestAlias
condition key, you should always include the "alias/" prefix as part of the alias name. This condition key allows or denies access to a KMS key based on the alias that identifies the key in a request.
Remember that while aliases provide a friendly way to refer to your KMS keys, they cannot be used directly in resource elements of IAM policies. For policy purposes, you must use the key ARN or key ID. The kms:RequestAlias
condition key, as you've used it, is the correct way to control access based on the alias in the request.
Also, keep in mind that aliases are unique within an AWS account and region, so make sure you're using the correct alias for the intended key and region.
Sources
Learn how to use aliases in your applications - AWS Key Management Service
AWS::KMS::Alias - AWS CloudFormation
Use aliases to control access to KMS keys - AWS Key Management Service
Relevant content
- asked a year ago
- AWS OFFICIALUpdated a year ago