Introduction
Each key managed by the AWS Key Management Service (KMS) must have a resource policy that describes what AWS security principals can use and manage the key. If you create a policy that does not include management privileges for any principal or if principals named in the policy are themselves deleted, you may find yourself unable to manage a KMS key. Fortunately AWS provides a way to regain control of the key in such a situation.
Note that even the root user for the AWS cannot manage KSM keys unless specifically allowed in the key policy!
Process
As of ,
References
- AWS documentation