Managing Policies

Policies can be applied to new AWS keys during and after creation. Saved policies (policy templates) are supported for all Native, BYOK, and CloudHSM keys.

For HYOK keys, policy templates are applicable to linked keys only.

This section covers the following topics:

• Creating New Policies

• Viewing Saved Policies

• Viewing Details of Saved Policies

• Updating Saved Policies

• Deleting Saved Policies

Creating New Policies

You must have the Add Key (BYOK, HYOK, or Native) or CloudHSM - Add Key permission to create a policy.

To create a policy:

1. Open the Cloud Key Manager application. By default, the AWS Keys tab is selected.

2. Click the Saved Policies tab.

3. Click Create Policy. The Select Account and Name Policy screen is displayed.

Select Account and Name Policy

1. Specify a unique policy Name.

2. Select the AWS KMS Account. The policy will be added to this account.

3. Click Next. The Configure Policy screen is displayed.

Configure Policy

Select the key admins, key users, and additional accounts for the policy. The Key Admins and Key Users tabs display the list of available AWS users and roles.

You can configure policy in either the Basic view or Raw view. The default view is Basic.

In the Basic view, Key Admins is the default tab.

1. On the Key Admins tab, select the desired key admins.

2. Click the Key Users tab.

3. Select the desired key users.

4. Add external accounts in the Add Accounts field and click +.

   These accounts have user permissions. Similarly, you can add more external accounts. To remove an account, click the close (X) icon in the account name.

   To switch to the Raw view, click Switch to policy (Raw) View. In the Raw view, paste a policy in JSON format in the Raw Policy field.

   Note

   Any edits made in the policy (Raw) view will be retained exclusively in the policy (Raw) view.

5. Click Next. The Review and Add screen is displayed.

Review and Add

Before adding the policy, review all the details. After the policy is added, certain features cannot be edited.

1. Review the policy and account details. If the details are incorrect or you want to modify them, click Back and update the details.

2. Click Add Policy.

The newly created policy appears on the Saved Policies tab. The status of the policy is Unverified.

Viewing Saved Policies

The Saved Policies tab of the AWS Keys page shows the list of existing key policies. Filter the policies by Policy Name, Account Name, or Account ID.

You must have the View Key (BYOK, HYOK, or Native) / CloudHSM - View Key permission to view policies.

To view the saved policies:

1. Open the Cloud Key Manager application. By default, the AWS Keys tab is selected.

2. Click the Saved Policies tab. The list of available policies is displayed. The tab shows the following details:

Viewing Details of Saved Policies

The detail view of a policy shows the associated keys and the policy.

You must have the View Key (BYOK, HYOK, or Native) / CloudHSM - View Key permission to view the policies.

To view the details of a policy:

1. Open the Cloud Key Manager application.

2. Click the Saved Policies tab. The list of available policies is displayed.

3. Click the Policy Name link of the desired policy.

   Alternatively, click the overflow icon () corresponding to the desired policy and click View Details.

The detail view shows the details of the associated keys and the policy under KEYS and POLICY sections.

Updating Saved Policies

You must have the Edit Key (BYOK, HYOK, or Native) or CloudHSM - Add Key permission to create a policy.

To update saved policies:

1. Open the Cloud Key Manager application.

2. Click the Saved Policies tab. The list of available policies is displayed.

3. Click the overflow icon () corresponding to the desired Saved Policy and click View Details.

   Alternatively, click the saved policy link under the Policy Name field to view the Saved Policy details.

4. Scroll down to the POLICY section, and select the view to update the policy, the options are Raw View and Basic View.

5. Click the desired tab to view the instructions.

   Raw View

   Make the necessary changes in the policy.

   Basic View

   In the Basic View, Key Admins is the default tab.

   1. On the Key Admins tab, select the desired key admins.

   2. Click the Key Users tab.

   3. Select the desired key users.

   Note

   If you make changes in one of the views and switch to the other view without updating the policy, you will see a Warning message. Click Yes to continue.

6. Click Update. The Update Policy message is displayed.

   Note

   To save the changes as a new policy, select the DO NOT Push Changes check box, and enter New Policy.

7. Click Apply.

Deleting Saved Policies

You must have the Schedule Key Delete, Delete Key (HYOK), or CloudHSM - Delete Key permission to delete a policy.

Only the policies with the status Unverified can be deleted. If a policy is associated with (or being used by) an AWS key, it cannot be deleted. So, before deleting a policy, make sure that is not associated with any AWS key.

To delete a policy:

1. Open the Cloud Key Manager application. By default, the AWS Keys tab is selected.

2. Click the Saved Policies tab.

3. Click the overflow icon () corresponding to the desired policy.

4. Click Delete Policy. A message box appears prompting to confirm the policy deletion.

   Deleting a policy is permanent and cannot be undone. After deletion, the policy cannot be retrieved.

5. Click Delete Policy. The policy is deleted.