json1 AWS.json

{
  {
    "Id": "auto-rds-2",
    "Statement": [
      {
        "Sid": "Allow access through RDS for all principals in the account that are authorized to use RDS",
        "Effect": "Allow",
        "Principal": {
          "AWS": "*"
        },
        "Action": [
          "kms:Encrypt",
          "kms:Decrypt",
          "kms:ReEncrypt*",
          "kms:GenerateDataKey*",
          "kms:CreateGrant",
          "kms:ListGrants",
          "kms:DescribeKey"
        ],
        "Resource": "*",
        "Condition": {
          "StringEquals": {
            "kms:ViaService": "rds.us-west-2.amazonaws.com",
            "kms:CallerAccount": "486381988016"
          }
        }
      },
      {
        "Sid": "Allow direct access to key metadata to the account",
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::486381988016:root"
        },
        "Action": [
          "kms:Describe*",
          "kms:Get*",
          "kms:List*",
          "kms:RevokeGrant"
        ],
        "Resource": "*"
      }
    ],
    "Version": "2012-10-17"
  }
}