// Module included in the following assemblies:
//
// * rosa_cluster_admin/autonode/rosa-autonode-cmk.adoc

:_mod-docs-content-type: REFERENCE
[id="rosa-nodes-autonode-managing-cmk-key-policy_{context}"]
= KMS key use policy for the {autonode}

[role="_abstract"]
The following key use policy must be attached to your customer-managed key (CMK) to allow the {autonode} to use it for root volume encryption. This policy grants the {autonode} IAM role the permissions to create and manage encrypted EBS volumes.

.Required KMS key use policy
[source,json,subs="+quotes"]
----
{
  "Sid": "Allow use of the key for Karpenter",
  "Effect": "Allow",
  "Principal": {
    "AWS": "<autonode_iam_role_arn>"
  },
  "Action": [
    "kms:Encrypt",
    "kms:Decrypt",
    "kms:ReEncrypt*",
    "kms:GenerateDataKey*",
    "kms:DescribeKey",
    "kms:CreateGrant",
    "kms:ListGrants",
    "kms:RevokeGrant"
  ],
  "Resource": "*",
  "Condition": {
    "Bool": {
      "kms:GrantIsForAWSResource": "true"
    }
  }
}
----
where:

`<autonode_iam_role_arn>`::
The ARN of the {autonode} IAM role. You can obtain this value by running `rosa describe cluster -c $CLUSTER_NAME -o json | jq -r '.aws.sts.auto_mode.role_arn'`.
