kms.yml

Actions:
  - Name: kms:CancelKeyDeletion
  - Name: kms:ConnectCustomKeyStore
  - Name: kms:CreateAlias
  - Name: kms:CreateCustomKeyStore
  - Name: kms:CreateGrant
  - Name: kms:CreateKey
  - Name: kms:Decrypt
  - Name: kms:DeleteAlias
  - Name: kms:DeleteCustomKeyStore
  - Name: kms:DeleteImportedKeyMaterial
  - Name: kms:DeriveSharedSecret
  - Name: kms:DescribeCustomKeyStores
  - Name: kms:DescribeKey
  - Name: kms:DisableKey
  - Name: kms:DisableKeyRotation
  - Name: kms:DisconnectCustomKeyStore
  - Name: kms:EnableKey
  - Name: kms:EnableKeyRotation
  - Name: kms:Encrypt
  - Name: kms:GenerateDataKey
  - Name: kms:GenerateDataKeyPair
  - Name: kms:GenerateDataKeyPairWithoutPlaintext
  - Name: kms:GenerateDataKeyWithoutPlaintext
  - Name: kms:GenerateMac
  - Name: kms:GenerateRandom
  - Name: kms:GetKeyPolicy
  - Name: kms:GetKeyRotationStatus
  - Name: kms:GetParametersForImport
  - Name: kms:GetPublicKey
  - Name: kms:ImportKeyMaterial
  - Name: kms:ListAliases
  - Name: kms:ListGrants
  - Name: kms:ListKeyPolicies
  - Name: kms:ListKeyRotations
  - Name: kms:ListKeys
  - Name: kms:ListResourceTags
  - Name: kms:ListRetirableGrants
  - Name: kms:PutKeyPolicy
  - Name: kms:ReplicateKey
  - Name: kms:RetireGrant
  - Name: kms:RevokeGrant
  - Name: kms:RotateKeyOnDemand
  - Name: kms:ScheduleKeyDeletion
  - Name: kms:Sign
  - Name: kms:TagResource
  - Name: kms:UntagResource
  - Name: kms:UpdateAlias
  - Name: kms:UpdateCustomKeyStore
  - Name: kms:UpdateKeyDescription
  - Name: kms:UpdatePrimaryRegion
  - Name: kms:Verify
  - Name: kms:VerifyMac

  # actions with no corresponding API
  - Name: kms:ReEncryptFrom
  - Name: kms:ReEncryptTo
  - Name: kms:SynchronizeMultiRegionKey

  # APIs without an IAM action
  - Name: kms:ReEncrypt