Key Policy and Access Control in AWS KMS

AWS KMS offers two types of keys: customer managed keys and built-in default keys. The main difference is that customer managed keys allow for changeable key policies, granting more control. However, if changes to the key policy are made and access is accidentally locked out, recovering from a key policy issue can be problematic. There is no built-in recovery mechanism like there is for deleting keys. Additionally, it has been discovered that modifying the key policy can grant unauthorized access, highlighting potential risks and concerns. This raises questions about the effectiveness and trustworthiness of KMS as an encryption service.