Managing access to KMS key to be used only a lambda

Question

I have a use case where a kms key would be used to encrypt and decrypt data . how can I make sure that only the specific lambda should be able to use the kms key from AWS polices .

I tried adding Lambda ARN in kms key policies while creating, but looks like its not allowed to do the same .

how can I achieve my use case ?

Answer 1

Here are the steps:

1. Create an IAM Role for Lambda without any permissions attached.

2. Select the same for Define key usage permissions while creating the key.

3. Attach the IAM Role to the Lambda.

4. Start using the KMS Key in the Lambda.

As per the AWS KMS documentation

The default key policy that the console creates for symmetric CMKs allows you to choose IAM users and roles in the account, and external AWS accounts, and make them key users.