Help improve AWS Support Official channel in re:Post and share your experience - complete a quick three-question survey to earn a re:Post badge!
KMS - Best practice on using root principal in Key policy
What are the best practices from AWS on using root Principle (delegate all access to IAM) vs tightly scoped individual IAM principles. what is the best practice from AWS on using root principle in Key Policy? Is it better to delegate access to IAM (aka root principle) or use tightly scoped principles for each individual IAM policy access?
- Newest
- Most votes
- Most comments
Below the best practices by AWS:
• Enable IAM Policies: AWS recommends enabling IAM policies in the key policy for most use cases, as it simplifies access management. • Use Least Privilege: Whether using the root principal or individual principals, always follow the principle of least privilege to minimize security risks. • Audit and Monitor: Regularly review key policies and IAM policies to ensure they align with your security and compliance requirements.
https://docs.aws.amazon.com/prescriptive-guidance/latest/encryption-best-practices/kms.html
https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
Relevant content
- asked 3 months ago
- asked 7 months ago
Hi, The pointed question is "Is it better to delegate access to IAM (aka root principle) or use tightly scoped principles for each individual IAM policy access?" - Is there any prescriptive guidance to answer this specific question ? Thanks.