Which functions can users perform using AWS KMS?
https://docs.aws.amazon.com/kms/latest/developerguide/control-access.html