Full ARN for KMS and DynamoDB Table about unicreds HOT 1 OPEN

You can use cross account roles with the AssumeRole (#70) support recently added to administrate across different accounts. But in this case you want to share the storage AND keys between accounts.

Generally it is frowned upon to share KMS keys across account. This is why things like encrypted volumes/snapshot can't be shared across account for instance.

I manage multiple accounts with credstash stores and each has their own store. Use something like terraform to manage the policies and such for consistently between accounts.

You do it how you want, but if you want a central store for all secrets, you should look at something outside of IAM (that is avail on private network) like vault, chef encrypted data bags, etc...

from unicreds.