Give persmission to use AWS KMS key to another account

Question

I created KMS key by using KMS client (PHP).

    `new KmsClient([
        'credentials' => [
            'key' => $awsKey,
            'secret' => $awsSecret,
        ],
        'version' => 'latest',
        'region' => 'us-east-1',
    ]);`

Now I want to share this key with some other users. I have their Account IDs,

How can I do that, by using RDS api?

Nothing works. I'm also unable to find any examples in GitHub examples.

Answer 1

You need to create a policy to give permission to another account access it. Check here for more details. 444455556666 is other account's id.

{
    "Sid": "Allow an external account to use this KMS key",
    "Effect": "Allow",
    "Principal": {
        "AWS": [
            "arn:aws:iam::444455556666:root"
        ]
    },
    "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
    ],
    "Resource": "*"
}