IAM customer managed policies should not allow decryption actions on all KMS keys

iam
이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

This control examines whether the default versions of IAM customer-managed policies permit principals to use AWS KMS decryption actions on all KMS resources. The control will fail if the policy allows any of the following actions on all KMS keys:

  • kms:*
  • kms:Decrypt
  • kms:ReEncryptFrom

The control specifically checks the Resource element of the policy and does not consider any conditions specified in the Condition element. It evaluates IAM policies meeting any of the following criteria:

  • Customer-managed policies attached to any IAM resource as a permissions policy
  • Customer-managed policies not attached to any IAM resource

It does not evaluate IAM policies meeting any of the following criteria:

  • Customer-managed policies attached to any IAM resource but used only as a boundary
  • Inline policies
  • AWS-managed policies

To enhance security, instead of granting permissions for all KMS keys, identify the specific keys that principals need to access encrypted data. Design policies to restrict user permissions to only those keys. For example, instead of allowing kms:Decrypt on all KMS keys, grant this permission only for keys in a particular region relevant to your account. Applying the principle of least privilege helps reduce the risk of unintentional data exposure.

Remediation

See the IAM Policies and Wildcards and Modifying Customer Managed Policies documentation for steps on how to identify and rectify policies that contain overly permissive KMS permissions.