Direct answer
KMS key access depends on the key policy, applicable IAM permissions and grants. Review who can use and administer a key separately, and protect recovery and application dependencies before changing policy.
Inventory keys and purpose
Record the AWS account, region, key identifier, owners, applications, data classification and recovery dependencies. Distinguish key administrators from applications that only need approved cryptographic operations.
Reference: AWS KMS: Key policies.
Review effective access
Inspect key policy, grants and relevant identity policies with the owner. Investigate broad principals or cross-account grants and document why they exist. Consider service integrations and conditions instead of assuming that one policy document shows all effective access.
- Record grant owners and intended lifetime.
- Identify emergency recovery and backup dependencies.
- Do not export plaintext or secret material into reports.
Test with a disposable key
In a test account, use synthetic data and a dedicated key to verify an approved principal's intended operation and another principal's denied operation. Compare audit evidence and provider diagnostics to understand the authorization decision.
Change and retest safely
Pilot narrowed access and verify encryption, decryption and recovery workflows that legitimately depend on the key. Coordinate production changes carefully; disabling or deleting a key can make protected data unavailable.
Assessment limits
KMS policy evaluation and service integrations are complex; a single test key does not prove access for all production keys. Do not disable or delete an in-use key as a test.
Frequently asked questions
Does encryption eliminate the need to review key permissions?
No. An authorized principal with key access may decrypt data; key administration and use both need review.
Is key rotation the same as changing who may use the key?
No. Key material rotation and access policy changes are different controls and need separate verification.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.