This document describes how to create a sub-account and grant it permission to manage KMS.
Step 1. Create a sub-account
- Log in to the CAM Console with your root account.
- On the User List page, click Create User to create a sub-account.
Step 2. Create an API key
- Click the sub-account name to enter the details page.
- Select API Key > Create Key to create
SecretKey. The API key is used to access KMS.
Step 3. Authorize the sub-account
The newly created sub-account can be granted with the access to KMS by associating a KMS policy.
- Go to Permissions > Associate Policies > Select Policies from the Policy List to Associate and select the appropriate KMS policy.
- Click Next > OK to grant KMS permission to the sub-account.