KMS CreateGrant Grantee Principal Resolver

Threat/Impact Level: HIGH | Exploitability/Downtime Risk: HIGH | Time to Fix: 10–20 mins

TL;DR

• What broke: The IAM principal calling CreateGrant is denied because either the KMS key policy does not grant kms:CreateGrant to that caller, the required kms:GrantIsForAWSResource condition is absent, or the grantee principal ARN is malformed/cross-account without explicit trust.
• How to fix it: Add kms:CreateGrant to the key policy for the calling principal; attach kms:GrantIsForAWSResource condition when the grant is for an AWS service; validate the grantee principal ARN resolves to an existing IAM entity.
• Fast path: Use our Client-Side Sandbox above to paste your key policy and get the refactored statement auto-generated without sending your ARNs to a third-party server.

An error occurred (AccessDenied) when calling the CreateGrant operation:
  User: arn:aws:iam::123456789012:role/MyServiceRole is not authorized
  to perform: kms:CreateGrant on resource:
  arn:aws:kms:us-east-1:123456789012:key/mrk-abc123def456
  with an explicit deny

How to Fix It (The Solution)

Root Cause Checklist — Check in Order

1. Key policy missing kms:CreateGrant for the calling role — most common.
2. kms:GrantIsForAWSResource condition missing — AWS services require this condition to be present before they accept grants.
3. Grantee principal ARN does not exist or is malformed — KMS validates the principal at grant creation time.
4. Cross-account grant without resource-based trust — the key policy in the owning account must explicitly allow the external account's principal.

Basic Fix — Key Policy Statement

{
  "Version": "2012-10-17",
  "Statement": [
-   {
-     "Sid": "AllowServiceRoleKeyUsage",
-     "Effect": "Allow",
-     "Principal": {
-       "AWS": "arn:aws:iam::123456789012:role/MyServiceRole"
-     },
-     "Action": [
-       "kms:Encrypt",
-       "kms:Decrypt",
-       "kms:GenerateDataKey"
-     ],
-     "Resource": "*"
-   }
+   {
+     "Sid": "AllowServiceRoleKeyUsageAndGrant",
+     "Effect": "Allow",
+     "Principal": {
+       "AWS": "arn:aws:iam::123456789012:role/MyServiceRole"
+     },
+     "Action": [
+       "kms:Encrypt",
+       "kms:Decrypt",
+       "kms:GenerateDataKey",
+       "kms:CreateGrant",
+       "kms:ListGrants",
+       "kms:RevokeGrant"
+     ],
+     "Resource": "*",
+     "Condition": {
+       "Bool": {
+         "kms:GrantIsForAWSResource": "true"
+       }
+     }
+   }
  ]
}

kms:GrantIsForAWSResource: true is non-negotiable. Without it, you are allowing unrestricted grant issuance.

Enterprise Best Practice — Least Privilege with Principal and Operation Constraints

{
  "Sid": "AllowServiceRoleGrant",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789012:role/MyServiceRole"
  },
- "Action": "kms:CreateGrant",
- "Resource": "*"
+ "Action": [
+   "kms:CreateGrant",
+   "kms:ListGrants",
+   "kms:RevokeGrant"
+ ],
+ "Resource": "*",
+ "Condition": {
+   "Bool": {
+     "kms:GrantIsForAWSResource": "true"
+   },
+   "StringEquals": {
+     "kms:ViaService": "rds.us-east-1.amazonaws.com"
+   },
+   "ArnLike": {
+     "aws:PrincipalArn": "arn:aws:iam::123456789012:role/MyServiceRole"
+   }
+ }
}

kms:ViaService locks grant creation to a specific AWS service. If your key is shared across services, use a StringLike with a wildcard: "rds.*.amazonaws.com". This prevents the service role from being used to issue grants outside its intended service boundary.

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# OPA/Conftest policy — deny CreateGrant without GrantIsForAWSResource condition
deny[msg] {
  stmt := input.Statement[_]
  stmt.Action[_] == "kms:CreateGrant"
  not stmt.Condition.Bool["kms:GrantIsForAWSResource"]
  msg := sprintf(
    "KMS key policy statement '%v' allows kms:CreateGrant without kms:GrantIsForAWSResource condition.",
    [stmt.Sid]
  )
}

# In your aws_kms_key policy document, always include:
condition {
  test     = "Bool"
  variable = "kms:GrantIsForAWSResource"
  values   = ["true"]
}