While creating a new KMS key using Cloudformation I see this message in the "Status Reason" column:
Did not have IAM permissions to process tags on AWS::KMS::Key resource
The cloudformation stack seems to be created correctly, but I was wondering what I can do to prevent this message from being shown?
I'm using the following Cloudformation template to create a KMS key:
AWSTemplateFormatVersion: "2010-09-09"
Description: "KMS key"
Outputs:
KeyArn:
Value: !Sub "${KmsKey.Arn}"
Resources:
KmsKey:
Properties:
Description: "KMS key"
Enabled: true
EnableKeyRotation: false
KeyPolicy:
Version: "2012-10-17"
Statement:
- Sid: "Enable IAM User Permissions"
Effect: "Allow"
Principal:
AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
Action: "kms:*"
Resource: "*"
Type: "AWS::KMS::Key"
KmsKeyAlias:
Properties:
AliasName: "alias/KmsKey"
TargetKeyId: !Ref "KmsKey"
Type: "AWS::KMS::Alias"
The role I use to create the resource allows the following actions:
- Action:
- kms:Create*
- kms:List*
Effect: "Allow"
Resource: "*"
- Action:
- kms:Describe*
- kms:Enable*
- kms:Put*
- kms:Update*
- kms:Get*
- kms:Decrypt
- kms:Encrypt
Effect: "Allow"
Resource:
- "arn:aws:kms:*:*:key/*"
My role was missing the following action:
- kms:TagResource