Policy: AWSKeyManagementServicePowerUser ARN: arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser Allowed Actions Actions Services iam:ListGroups iam iam:ListRoles iam iam:ListUsers iam kms:CreateAlias kms kms:CreateKey kms kms:DeleteAlias kms kms:Describe* kms kms:GenerateRandom kms kms:Get* kms kms:List* kms kms:TagResource kms kms:UntagResource kms