> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# AWS Key Management Service (KMS)
> Connect AWS KMS to Iru Compliance with a cross-account IAM role to collect key inventory, rotation status, and grant metadata without decrypt privileges.
### About AWS Key Management Service (KMS)
The **AWS Key Management Service** connector gathers **key metadata**, **aliases**, **policies**, **grants**, **tags**, and **rotation status** so controls can prove how keys are governed. Iru uses **`sts:AssumeRole`** with an **external ID**. The recommended inline policy below avoids **`kms:Decrypt`** and other cryptographic data operations (metadata only).
### How It Works
Iru runs in its own AWS account. To read **KMS** key metadata in your account, you create an **IAM role** with **`sts:AssumeRole`** trust (wizard **External ID**) and read-only **`kms:`** permissions appropriate for inventory (avoid policies that bundle write-style capabilities). Paste the role’s **ARN** back into Iru.
Skip **`AWSKeyManagementServicePowerUser`** for this use case - it bundles write-style capabilities. Use the explicit inline JSON from the wizard path or the template below.
| Detail | Value |
| ------------------ | ----------------------- |
| **Category** | Security / cryptography |
| **Authentication** | Cross-account IAM role |
References: [KMS developer guide](https://docs.aws.amazon.com/kms/latest/developerguide/), [IAM policies for KMS](https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies.html).
### Prerequisites
* IAM admin rights to publish roles.
* Live connector strings (**principal**, **external ID**).
### Connect AWS KMS to Iru
Start here: open the source wizard and copy the **trust policy** (and note the **external ID**). When you are ready to create the role in AWS, switch to the [**AWS**](#aws) tab and follow [**Create the IAM role in AWS**](#create-the-iam-role-in-aws). After you have the **Role ARN**, return to the [**Iru Compliance**](#iru-compliance) tab and complete [**Submit the role ARN in Iru**](#submit-the-role-arn-in-iru) below.
#### Get the trust policy from Iru
In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.
Find **AWS KMS** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. Leave the **Iru is requesting access to external services** wizard tab open.
The wizard shows the **trust policy** JSON your IAM role must use (**Principal** and **sts:ExternalId**). Below is an **example** of the structure; **copy the live JSON from your wizard** so the account, principal ARN, and external ID match exactly.
```json copy=false lines theme={null}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::753695775620:role/IruConnect"
},
"Condition": {
"StringEquals": {
"sts:ExternalId": "YOUR_EXTERNAL_ID"
}
},
"Action": "sts:AssumeRole"
}
]
}
```
Keep the Iru wizard tab open for reference, then switch to the [**AWS**](#aws) tab and follow [**Create the IAM role in AWS**](#create-the-iam-role-in-aws).
#### Submit the role ARN in Iru
Finish the [**AWS**](#aws) tab first (through [**Create the IAM role in AWS**](#create-the-iam-role-in-aws)) so you have the **Role ARN** from the new role.
Return to the Iru wizard tab. Paste the **Role ARN** where the connector prompts for it.
Click **Submit Role**. When the connection succeeds, the wizard shows **Connection Configured**.
Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **AWS KMS** card is **Active**.
Complete [**Get the trust policy from Iru**](#get-the-trust-policy-from-iru) on the [**Iru Compliance**](#iru-compliance) tab before you create this role. Use the **external ID** and trust policy from the live wizard when you configure **Trusted entity**.
#### Create the IAM role in AWS
Open **IAM** → **Roles** → **Create role**.
Choose **AWS account** → **Another AWS account**. Enter **`753695775620`** (unless your wizard lists another ID). Enable **Require external ID** and paste the external ID from Iru.
Advance without attaching **`AWSKeyManagementServicePowerUser`** or other broad KMS write-capable policies.
Add this **inline policy**:
```json lines theme={null}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"kms:ListKeys",
"kms:ListAliases",
"kms:DescribeKey",
"kms:GetKeyPolicy",
"kms:GetKeyRotationStatus",
"kms:ListGrants",
"kms:ListKeyPolicies",
"kms:ListResourceTags"
],
"Resource": "*"
}
]
}
```
No **`kms:Decrypt`**, **`kms:Encrypt`**, or **`GenerateDataKey`**. Iru cannot use your keys to process ciphertext.
Name the role, create it, and copy the **Role ARN**. Switch back to the [**Iru Compliance**](#iru-compliance) tab and complete [**Submit the role ARN in Iru**](#submit-the-role-arn-in-iru).
Continue on the [**Iru Compliance**](#iru-compliance) tab to paste the **Role ARN** and finish the wizard ([**Submit the role ARN in Iru**](#submit-the-role-arn-in-iru)).
### Troubleshooting
Check **pop-up blocker** settings for the Iru site and try again.
Fix external ID drift.
Resource policies on individual keys may deny **`DescribeKey`** - adjust key policies if auditors require full visibility.
Always listed but sometimes less introspectable than customer-managed keys - expected per AWS behavior.
### Considerations
Keys are **Regional**; inventory spans enabled Regions.
Works purely off **API metadata** - no key material leaves KMS through decrypt calls from this connector.
### Related Articles
Browse and manage every Compliance source.
Frameworks, actions, and **Artifacts**.
How Endpoint, Compliance, and Identity fit together.
Upload, review, and organize evidence from sources and actions.