We cannot use a KMS Key alias or alias ARN or Alias id to represent a KMS key in an IAM policy. This is because of a security reason as the alias can be attached to another key and this can result in privileged escalation.

So for usage in IAM policies, only use the KMS key arn instead of alias. You can find the details in the AWS IAM best practices documentation.

Advertisement