Tengo un grupo de IAM llamado group-dev y un par de usuarios adjuntos a este grupo, tengo una política de IAM personalizada (a continuación). ¿Esta política de IAM por sí sola es suficiente para que los usuarios de ese grupo cifren y enumeren las claves de kms?

Básicamente, mi objetivo es crear un grupo de IAM con una política adjunta a un par de usuarios, y cuando se agregan nuevos usuarios, no quiero hacer un doble trabajo, como agregarlos al grupo y luego agregarlos a la política de claves de kms. Entonces, ¿funcionaría con las siguientes políticas?

Política integrada de grupo de IAM

 { "Action": [ "kms:List*", "kms:Encrypt", "kms:Decrypt", "kms:Describe*", "kms:Get*" ], "Effect": "Allow", "Resource": "*" }, kms policy { "Id": "key-consolepolicy", "Version": "2012-10-17", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::xxxxxxxxxx:root" }, "Action": "kms:*", "Resource": "*" }

A continuación se muestran fragmentos de aws doc: https://docs.amazonaws.cn/en_us/kms/latest/developerguide/kms-dg.pdf#page=95&zoom=100,96,105

 Allowing multiple IAM users to access a CMK IAM groups are not valid principals in a key policy. To allow multiple IAM users to access a CMK, do one of the following: • Add each IAM user to the key policy. This approach requires that you update the key policy each time the list of authorized users changes. • Ensure that the key policy includes the statement that enables IAM policies to allow access to the CMK (p. 72). Then create an IAM policy that allows access to the CMK, and then attach that policy to an IAM group that contains the authorized IAM users. Using this approach, you don't need to change any policies when the list of authorized users changes. Instead, you only need to add or remove those users from the appropriate IAM group.

Parece que hay declaraciones contradictorias, ¿o es algo que no entendí bien?

 . Enables IAM policies to allow access to the CMK. IAM policies by themselves are not sufficient to allow access to a CMK. However, you can use them in combination with a CMK's key policy if the key policy enables it. Giving the AWS account full access to the CMK does this; it enables you to use IAM policies to give IAM users and roles in the account access to the CMK. It does not by itself give any IAM users or roles access to the CMK, but it enables you to use IAM policies to do so. For more information, see Managing access to AWS KMS CMKs (p. 69).