---
title: KMS key policy should not allow everyone to use it
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > KMS key policy should not allow
  everyone to use it
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# KMS key policy should not allow everyone to use it
 
## Description{% #description %}

KMS keys are assigned a resource-based policy that controls who can use and manage the key. This rule fails when the key policy has an `Allow` statement for every principal (`*`) that is not limited to specific callers.

A public statement is considered restricted when it has a condition on the caller's account, organization, principal ARN, user ID, request source, or VPC, using a positive `String` or `Arn` operator with values that do not leave the account or organization open. Conditions such as `kms:ViaService` alone, negated operators, `IfExists` operators, `ForAllValues` operators, and wildcard or policy-variable values do not restrict callers.

This rule evaluates key policies through key aliases, so keys without an alias are not evaluated.

## Rationale{% #rationale %}

When the key policy is misconfigured, principals in any AWS account can use the key, for example, to decrypt data or create grants.

## Remediation{% #remediation %}

### From the console{% #from-the-console %}

1. Go to the list of customer-managed KMS keys at [https://console.aws.amazon.com/kms/home#/kms/keys](https://console.aws.amazon.com/kms/home#/kms/keys).

1. Click the vulnerable KMS key name.

1. In the **Key Policy** tab, remove the statement making the key publicly accessible, or add a condition such as `kms:CallerAccount` or `aws:PrincipalOrgID` that limits it to trusted callers.

### From the command line{% #from-the-command-line %}

1. Retrieve the current key policy:

```
aws kms get-key-policy \
   --key-id <KEY_ARN> \
   --policy-name default \
   --query Policy --output text > key_policy.json
```
Remove or restrict the statement making the key publicly accessible, then update the key policy:
```
aws kms put-key-policy \
   --key-id <KEY_ARN> \
   --policy-name default \
   --policy file://./key_policy.json
```

## References{% #references %}

1. [https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html]
1. [https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-resources.html#access-analyzer-kms-key]