AWS Key management service CLI commands - amazon-web-services

Question

I am using command :
put-key-policy --key-id <keyid> --policy-name <default> --policy <value>
I get the error
MalformedPolicyDocumentException
I think its because I didn’t understand the value –policy parameter takes.
Any links I can refer?

Answer 1

I came across the same thing myself and I hope this helps. This was done on a FreeBSD server, so windows users will have to make appropriate adjustments. If you run something like:
$ aws kms put-key-policy --generate-cli-skeleton
You'll get back a skeleton of what the cli is looking for as input:
{
"KeyId": "",
"PolicyName": "",
"Policy": "",
"BypassPolicyLockoutSafetyCheck": true
}
Meaning that the allowable input is a piece of JSON with up to 4 possible parameters. In this case we're looking to create a new policy so the only one we really need is "Policy". What's required is a JSON policy in the form of a string. Using the following as an example:
{
"Version" : "2012-10-17",
"Id" : "key-consolepolicy-3"
}
First escape the double quotes, giving:
{
\"Version\" : \"2012-10-17\",
\"Id\" : \"key-consolepolicy-3\"
}
Then replace the newlines by \n characters, giving:
{\n \"Version\" : \"2012-10-17\",\n \"Id\" : \"key-consolepolicy-3\"\n }
And then we put this into double quotes:
"{\n \"Version\" : \"2012-10-17\",\n \"Id\" : \"key-consolepolicy-3\"\n }"
And finally our file looks like this:
{
"Policy" : "{\n \"Version\" : \"2012-10-17\",\n \"Id\" : \"key-consolepolicy-3\"\n }"
}
If you already have a key with a policy you'd like to use then you can simply retrieve it:
$ aws kms get-key-policy --policy-name default --key-id XXXXXXXXX > policy
Whichever way you create it, you can then use the policy in the file to update the policy for the new key:
$ aws kms put-key-policy --key-id YYYYYYYY --policy-name default --cli-input-json file://policy
On Windows, the "file://policy" would be something like: "file://C:\path\to\policyfile.json"
If you're going to use the --policy command line argument rather than a policy in a file, --policy is also looking for a JSON policy in the form of a string, so you need
$ aws kms put-key-policy --key-id YYYYYYYY --policy-name default --policy "{\n \"Version\" : \"2012-10-17\",\n \"Id\" : \"key-consolepolicy-3\"\n }"