Ends in

24-Hour Anniversary Sale Extension! $3 OFF ALL Reviewers

Customer Master Key (CMK) Policy Management in AWS KMS

Home » AWS Cheat Sheets » AWS Security & Identity Services » Security Related Notes » Customer Master Key (CMK) Policy Management in AWS KMS

Customer Master Key (CMK) Policy Management in AWS KMS

What is a Customer Master Key (CMK)?

In security, a master key is what you use to encrypt all other encryption keys in your system. Customer master keys are logical representations of a master key. They are the primary resources in AWS KMS. The CMK contains the key material used to encrypt and decrypt data. It also contains metadata such as the key ID, creation date, description, and key state.

You can start using AWS KMS through the web console or via API. There are two types of CMKs that you can create in AWS KMS: symmetric CMK and asymmetric CMK. 

  • A symmetric CMK is a 256-bit key that is used for standard encryption and decryption. 
  • An asymmetric CMK, on the other hand, is an RSA key pair that is used for encryption and decryption or signing and verification, but not both, or an elliptic curve (ECC) key pair that is used for signing and verification.

Likewise, AWS breaks down CMK ownership into three categories: customer-managed CMKs, AWS managed CMKs, and AWS owned CMKs. Generally, when you create a CMK, AWS KMS provides the key material for it; But if you require to have full control of your keys, customer-managed CMKs allow you to upload your own key material into AWS. The level of control you have varies for each category, with customer-managed CMKs being the most unrestricted, to AWS owned CMKs being the most restrictive. 

How To Manage Access To Your CMKs

To protect your CMKs from unauthorized access, you must attach a key policy to it. Key policies help protect your CMKs by defining specific requirements that must be fulfilled before an action is permitted. The policy structure is similar to IAM policies, and it also uses JSON formatting. Here is a basic example of a key policy:

Tutorials dojo strip

Customer Master Keys (CMKs)

To create your key policy, you must first indicate the policy version you will be using. Then in the statement body, you must include the following parameters:

  • Effect – indicates whether the policy will allow or deny actions
  • Principal – the identity to which the policy will grant or deny permissions to
  • Action – the permissions that you want to grant/deny to the principal
  • Resource – the list of objects that your policy will be applied to

You can also include the following optional parameters in your statement body:

  • Sid – a unique identifier for your policy
  • Conditions – conditions that need to be met before your policy takes effect

The AWS KMS documentation has a list of all accepted values for the policy body, along with some examples to guide you through.

The key policy applied to a CMK created through the AWS KMS API

When you create a CMK using the API and you do not provide a key policy in the parameters, AWS automatically creates and assigns a default key policy for your CMK. This default key policy has one policy statement that gives the AWS root account that owns the CMK full access to the CMK and enables IAM policies in the account to allow access to the CMK. If later on, you decide to change the contents of the key policy, you need to create a new policy and attach it to your CMK to replace the old one.

The key policy applied to a CMK created through the AWS Management Console

When you create a CMK with the AWS Management Console, you can choose the IAM users, IAM roles, and AWS accounts that should be given access to the CMK, and these will be added to a default key policy that the console creates for you. With the console, you can view or modify your key policies. The default key policy gives the AWS root account that owns the CMK full access to the CMK. You can also specify in the default key policy which IAM users and roles will be key administrators and key users, which have different respective policy statements.

Note: If you are studying for the AWS Certified Security Specialty exam, we highly recommend that you take our AWS Certified Security – Specialty Practice Exams and read our Security Specialty exam study guide.

AWS Certified Security - Specialty Exam Study Path


Tutorials Dojo portal

Enroll Now – Our AWS Certification Exam Reviewers

AWS Practice Exams Tutorials Dojo

FREE AWS Exam Readiness Digital Courses

Enroll Now – Our Azure Certification Exam Reviewers

azure reviewers tutorials dojo

Enroll Now – Our Google Cloud Certification Exam Reviewers

Tutorials Dojo Exam Study Guide eBooks

tutorials dojo study guide eBook

Subscribe to our YouTube Channel

Tutorials Dojo YouTube Channel

FREE Intro to Cloud Computing for Beginners

FREE AWS, Azure, GCP Practice Test Samplers

Recent Posts

AWS, Azure, and GCP Certifications are consistently among the top-paying IT certifications in the world, considering that most companies have now shifted to the cloud. Earn over $150,000 per year with an AWS, Azure, or GCP certification!

Follow us on LinkedIn, YouTube, Facebook, or join our Slack study group. More importantly, answer as many practice exams as you can to help increase your chances of passing your certification exams on your first try!

View Our AWS, Azure, and GCP Exam Reviewers Check out our FREE courses

Our Community

passing rate
Around 95-98% of our students pass the AWS Certification exams after training with our courses.
Over 200k enrollees choose Tutorials Dojo in preparing for their AWS Certification exams.
Our courses are highly rated by our enrollees from all over the world.

What our students say about us?