Configure AWS KMS key policies, IAM policies, and grants for least-privilege key access

Steps

1. Understand the evaluation model: a KMS key policy is the primary resource-based policy; IAM identity policies can delegate permissions only if the key policy explicitly allows the account or IAM entities
2. Write a key policy with a root principal statement (the AWS account) to prevent lock-out, then add specific statements granting kms:Encrypt, kms:Decrypt, kms:GenerateDataKey, or kms:DescribeKey to the intended principals
3. For cross-account or service access, add the external account principal or AWS service principal to the key policy; do not rely solely on IAM policies across account boundaries
4. Use KMS grants for temporary or delegated access (e.g., AWS services acting on behalf of a user); grants can be retired without modifying the key policy
5. Audit effective permissions with IAM Policy Simulator and CloudTrail kms:* events; look for overly broad principals like '*'
6. Enable key deletion protection and set a pending deletion window (consult current docs for minimum window); require MFA or an approval workflow before scheduling deletion