get_key_policy ¶

def get_key_policy(
    self,
    key_id: "capo_kms.types.key_id_type.KeyIdType",
    *,
    config_overrides: Optional[KMSClientConfig] = None,
    policy_name: Optional["capo_kms.types.policy_name_type.PolicyNameType"] = None,
) -> "capo_kms.types.get_key_policy_response.GetKeyPolicyResponse":
    """<p>Gets a key policy attached to the specified KMS key.</p> <p> <b>Cross-account use</b>: No. You cannot perform this operation on a KMS key in a different Amazon Web Services account.</p> <p> <b>Required permissions</b>: <a href="https://docs.aws.amazon.com/kms/latest/developerguide/kms-api-permissions-reference.html">kms:GetKeyPolicy</a> (key policy)</p> <p> <b>Related operations</b>: <a href="https://docs.aws.amazon.com/kms/latest/APIReference/API_PutKeyPolicy.html">PutKeyPolicy</a> </p> <p> <b>Eventual consistency</b>: The KMS API follows an eventual consistency model. For more information, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/accessing-kms.html#programming-eventual-consistency">KMS eventual consistency</a>.</p>

    Args:
        key_id: <p>Gets the key policy for the specified KMS key.</p> <p>Specify the key ID or key ARN of the KMS key.</p> <p>For example:</p> <ul> <li> <p>Key ID: <code>1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li> <li> <p>Key ARN: <code>arn:aws:kms:us-east-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab</code> </p> </li> </ul> <p>To get the key ID and key ARN for a KMS key, use <a>ListKeys</a> or <a>DescribeKey</a>.</p>
        policy_name: <p>Specifies the name of the key policy. If no policy name is specified, the default value is <code>default</code>. The only valid name is <code>default</code>. To get the names of key policies, use <a>ListKeyPolicies</a>.</p>

    Raises:
        capo_kms.errors.dependency_timeout_exception.DependencyTimeoutException: <p>The system timed out while trying to fulfill the request. You can retry the request.</p>
        capo_kms.errors.invalid_arn_exception.InvalidArnException: <p>The request was rejected because a specified ARN, or an ARN in a key policy, is not valid.</p>
        capo_kms.errors.kms_internal_exception.KMSInternalException: <p>The request was rejected because an internal exception occurred. The request can be retried.</p>
        capo_kms.errors.kms_invalid_state_exception.KMSInvalidStateException: <p>The request was rejected because the state of the specified resource is not valid for this request.</p> <p>This exceptions means one of the following:</p> <ul> <li> <p>The key state of the KMS key is not compatible with the operation. </p> <p>To find the key state, use the <a>DescribeKey</a> operation. For more information about which key states are compatible with each KMS operation, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html">Key states of KMS keys</a> in the <i> <i>Key Management Service Developer Guide</i> </i>.</p> </li> <li> <p>For cryptographic operations on KMS keys in custom key stores, this exception represents a general failure with many possible causes. To identify the cause, see the error message that accompanies the exception.</p> </li> </ul>
        capo_kms.errors.not_found_exception.NotFoundException: <p>The request was rejected because the specified entity or resource could not be found.</p>
        capo_kms.errors.UnknownServiceError: The service returned an error code this client does not model.

    Examples:
        To retrieve a key policy
        The following example retrieves the key policy for the specified KMS key.

        >>> client.get_key_policy(key_id='1234abcd-12ab-34cd-56ef-1234567890ab', policy_name='default')
    """

    def _handler(
        req: "OperationRequest[capo_kms.types.get_key_policy_request.GetKeyPolicyRequest]",
    ) -> OperationResponse[
        "capo_kms.types.get_key_policy_response.GetKeyPolicyResponse"
    ]:
        import capo_kms._operations.trent_service.get_key_policy

        output, http_response = (
            capo_kms._operations.trent_service.get_key_policy.get_key_policy(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("GetKeyPolicy")
    )
    input_: capo_kms.types.get_key_policy_request.GetKeyPolicyRequest = {
        "key_id": key_id
    }
    if policy_name is not None:
        input_["policy_name"] = policy_name

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output