fix(IAM): add kms:DescribeKey to default IAM policies

fubuloubu · fubuloubu · commit f21faa6a92ea · 2025-05-12T15:24:14.000-04:00
diff --git a/ape_aws/iam/client.py b/ape_aws/iam/client.py
@@ -98,7 +98,7 @@ class IamClient(Session):
     KEY_ACCESS_POLICY = dict(
         Sid="ApeAWSv1",
         Effect="Allow",
-        Action=["kms:ListAliases", "kms:Sign", "kms:Verify", "kms:GetPublicKey"],
+        Action=["kms:ListAliases", "kms:Sign", "kms:Verify", "kms:GetPublicKey", "kms:DescribeKey"],
         Resource="*",
     )
 

Original file line number	Diff line number	Diff line change
`@@ -98,7 +98,7 @@ class IamClient(Session):`
`98`	`98`	`KEY_ACCESS_POLICY = dict(`
`99`	`99`	`Sid="ApeAWSv1",`
`100`	`100`	`Effect="Allow",`
`101`		`- Action=["kms:ListAliases", "kms:Sign", "kms:Verify", "kms:GetPublicKey"],`
	`101`	`+ Action=["kms:ListAliases", "kms:Sign", "kms:Verify", "kms:GetPublicKey", "kms:DescribeKey"],`
`102`	`102`	`Resource="*",`
`103`	`103`	`)`
`104`	`104`