Guides

Ensure that KMS key policy does not allow access to everyone

Do not set the Principal to an asterisk * in any key policy statement that allows permissions unless you use conditions to limit the key policy. An asterisk gives every identity in every AWS account permission to use the KMS key, unless another policy statement explicitly denies it. Users in other AWS accounts just need corresponding IAM permissions in their own accounts to use the KMS key.

Suggest Edits

Risk Level: High
Cloud Entity: AWS Key Management Service (KMS)
CloudGuard Rule ID: D9.CFT.CRY.13
Covered by Spectral: Yes
Category: Security, Identity, & Compliance

GSL LOGIC

AWS_KMS_Key should not have KeyPolicy.Statement contain-any [ Principal='*' or Principal.AWS='*' ]

REMEDIATION

From CFT
Set AWS::KMS::Key Principal property under KeyPolicy.Statement to a specific account or user or add a condition to restrict the access.

References

  1. https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html
  2. https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying.html#key-policy-modifying-how-to
  3. https://docs.aws.amazon.com/cli/latest/reference/kms/put-key-policy.html

AWS Key Management Service (KMS)

AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses FIPS 140-2 validated hardware security modules to protect the security of your keys. AWS Key Management Service is integrated with most other AWS services to help you protect the data you store with these services. AWS Key Management Service is also integrated with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs.

Compliance Frameworks

  • AWS CloudFormation ruleset

Updated over 1 year ago