Granting permissions programmatically with grants

KMS grants can be used to give temporary granular permissions to AWS KMS API operations such as encrypt, decrypt, describe keys, and more. We can use grants to provide access to a user in their own account or even another account. In this recipe, we will grant access to a user so that they can encrypt and decrypt files using AWS KMS.

Getting ready

We need a working AWS account and two users: an administrator user and a user with no permissions. The CLI profiles should be configured for these users. I will be calling these users and their CLI profiles awssecadmin and testuser, respectively.

Create a KMS key by following previous recipes in this chapter. Alternatively, use the...