Hello and welcome to this final lecture of this course where I just want to quickly recap some of the key points taken from the previous lectures.  

I began this course focusing on KMS permissions and key policies, and within this lecture, I explained that:

• Key policies are resource based policies and are tied to your KMS key.
• The key policy is JSON based and the document syntax is much like that of IAM policies.
• To enable IAM Permissions to be effective as an access control method you must enable them within the key policy.
• If you don’t enable IAM permissions then any IAM policy that allows access to the key will be ignored, unless they are being used to deny access.
• Key Administrators can either be users or roles.
• Key admins can only administer the KMS key and not use it to perform any encryption functions.
• Key admins can delete the key if access is given to do so.
• Key admins can perform operations such as Update, Delete, Enable, ScheduleKeyDeletion, etc.
• Key users define who can use the key to perform cryptographic functions.
• Operations performed by Key users include both encrypt and decrypt data, re-encrypt data, generate data keys from the KMS key, and also describe the key.
• Grants allow you to delegate a subset of permissions that a Key user has to another principal on a temporary basis without having to update the Key Policy.
• Grants are also used by different AWS services that integrate with KMS.  
• Grants can only be created using the CLI.
• After creating a grant, there could be a delay until the operation achieves eventual consistency.

Following this lecture, I then gave a demonstration showing you how to create a new KMS key using the AWS Management Console and how the key policy is built to include key administrators, users, and grants. 

Finally, I covered the policy evaluation logic to explain how access is granted when key policies, IAM policies, and Grants are all being used to grant access and which permissions override others.

That now brings me to the end of this lecture and to the end of this course, and so you should now have a greater understanding of some of the different methods you can use to secure your KMS keys.

Feedback on our courses here at Cloud Academy is valuable to both us as trainers and any students looking to take the same course in the future. If you have any feedback, positive or negative, it would be greatly appreciated if you could contact support@cloudacademy.com.

Thank you for your time and good luck with your continued learning of cloud computing. Thank you.