kms:Decrypt
Literal appearances in AWS managed IAM policies. Statements that use wildcards (for example s3:*) are not counted here. This is not an IAM authorization simulation.
Policies (any)
86
Allow (Action)
86
Deny (Action)
2
NotAction
5
Index generated 4/7/2026, 1:17:11 PM. 561 policies include at least one wildcard action string (any service).
Action reference
SAR-style (unofficial)Service: AWS Key Management Service
Access level
WriteDescription
Controls permission to decrypt ciphertext that was encrypted under an AWS KMS key
Resource types
- key*
Allow (Action)
- AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy
- AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy
- AWS-SSM-RemediationAutomation-AdministrationRolePolicy
- AWS-SSM-RemediationAutomation-ExecutionRolePolicy
- AWSBackupAdminPolicy
- AWSBackupGuardDutyRolePolicyForScans
- AWSBackupOperatorPolicy
- AWSBackupSearchOperatorAccess
- AWSBackupServiceRolePolicyForBackup
- AWSBackupServiceRolePolicyForIndexing
- AWSBackupServiceRolePolicyForItemRestores
- AWSBackupServiceRolePolicyForRestores
- AWSBackupServiceRolePolicyForS3Backup
- AWSBackupServiceRolePolicyForS3Restore
- AWSDeadlineCloud-UserAccessFarms
- AWSIdentityCenterExternalManagementPolicy
- AWSLicenseManagerLinuxSubscriptionsServiceRolePolicy
- AWSObservabilityAdminLogsCentralizationServiceRolePolicy
- AWSRefactoringToolkitFullAccess
- AWSSSODirectoryAdministrator
- AWSSSODirectoryReadOnly
- AWSSSOMasterAccountAdministrator
- AWSSSOMemberAccountAdministrator
- AWSSSOReadOnly
- AWSSecretsManagerClientReadOnlyAccess
- AWSServiceRoleForAWSTransform
- AWSServiceRoleForImageBuilder
- AWSServiceRoleForMonitronPolicy
- AWSServiceRoleForUserSubscriptions
- AWSSupplyChainFederationAdminAccess
- AWSSystemsManagerChangeManagementServicePolicy
- AWSSystemsManagerJustInTimeAccessServicePolicy
- AWSTransformApplicationDeploymentPolicy
- AWSTransformSecretsManagerConnectorPolicy
- AmazonAuroraDSQLConsoleFullAccess
- AmazonAuroraDSQLFullAccess
- AmazonBedrockStudioPermissionsBoundary
- AmazonCognitoUnAuthedIdentitiesSessionPolicy
- AmazonDataZoneEnvironmentRolePermissionsBoundary
- AmazonDataZoneFullAccess
- AmazonDataZoneGlueManageAccessRolePolicy
- AmazonDataZoneProjectDeploymentPermissionsBoundary
- AmazonDataZoneProjectRolePermissionsBoundary
- AmazonDataZoneRedshiftGlueProvisioningPolicy
- AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
- AmazonDocDBElasticFullAccess
- AmazonEVSServiceRolePolicy
- AmazonEventBridgeApiDestinationsServiceRolePolicy
- AmazonInspector2AgentlessServiceRolePolicy
- AmazonRDSCustomInstanceProfileRolePolicy
- AmazonS3TablesLakeFormationServiceRole
- AmazonSageMakerModelRegistryFullAccess
- AmazonSageMakerNotebooksServiceRolePolicy
- AmazonSageMakerSpacesControllerPolicy
- AmazonSageMakerSpacesRouterPolicy
- AmazonSecurityLakePermissionsBoundary
- BedrockAgentCoreFullAccess
- CloudWatchLogsAPIKeyAccess
- CloudWatchSyntheticsFullAccess
- DBModDiscoveryAndAssessment
- EC2InstanceProfileForImageBuilder
- EC2InstanceProfileForImageBuilderECRContainerBuilds
- MultiPartyApprovalFullAccess
- MultiPartyApprovalReadOnlyAccess
- ROSAKMSProviderPolicy
- SageMakerStudioAdminIAMConsolePolicy
- SageMakerStudioAdminIAMDefaultExecutionPolicy
- SageMakerStudioAdminIAMPermissiveExecutionPolicy
- SageMakerStudioBedrockAgentServiceRolePolicy
- SageMakerStudioBedrockChatAgentUserRolePolicy
- SageMakerStudioBedrockEvaluationJobServiceRolePolicy
- SageMakerStudioBedrockFlowServiceRolePolicy
- SageMakerStudioBedrockFunctionExecutionRolePolicy
- SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy
- SageMakerStudioBedrockPromptUserRolePolicy
- SageMakerStudioDomainServiceRolePolicy
- SageMakerStudioEMRInstanceRolePolicy
- SageMakerStudioEMRServiceRolePolicy
- SageMakerStudioFullAccess
- SageMakerStudioProjectProvisioningRolePolicy
- SageMakerStudioProjectRoleMachineLearningPolicy
- SageMakerStudioProjectUserRolePermissionsBoundary
- SageMakerStudioProjectUserRolePolicy
- SageMakerStudioUserIAMConsolePolicy
- SageMakerStudioUserIAMDefaultExecutionPolicy
- SageMakerStudioUserIAMPermissiveExecutionPolicy
Thanks to Ian McKay for iam-dataset (MIT), structured data derived from the AWS Service Authorization Reference. Not maintained by AWS and not guaranteed current. IAMTrail's managed policy archive is separate.
Definitions bundle generated 4/7/2026, 1:17:11 PM