Jul 10, 2018

If this user is not provided the permission from the KMS Key policy end then he will be implicitly denied of the action.

The IAM user needs to have permission for the “ListKeyPolicies” API from the KMS Key policy end as well. If this user is not provided the permission from the KMS Key policy end then he will be implicitly denied of the action. Please refer here for steps to modify KMS key policy.