Ensure that an inline KMS key policy does not allow full administrative rights
KMS key policy should be setup in such a way that it follows the least privilege principle. Allowing full admin rights may result into critical security loopholes in the system.
Risk Level: High
Cloud Entity: AWS Key Management Service (KMS)
CloudGuard Rule ID: D9.CFT.IAM.37
Covered by Spectral: Yes
Category: Security, Identity, & Compliance
GSL LOGIC
AWS_KMS_Key should not have KeyPolicy.Statement contain-any [ Effect='Allow' and (Principal='*' or Principal.AWS='*') and Resource='*' and Action='*' ]
REMEDIATION
From CFT
Set AWS::KMS::Key Principal, Resource and Action properties in KeyPolicy.Statement to specific values.
References
- https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html
- https://docs.aws.amazon.com/cli/latest/reference/kms/put-key-policy.html
AWS Key Management Service (KMS)
AWS Key Management Service (KMS) is a managed service that makes it easy for you to create and control the encryption keys used to encrypt your data, and uses FIPS 140-2 validated hardware security modules to protect the security of your keys. AWS Key Management Service is integrated with most other AWS services to help you protect the data you store with these services. AWS Key Management Service is also integrated with AWS CloudTrail to provide you with logs of all key usage to help meet your regulatory and compliance needs.
Compliance Frameworks
- AWS CloudFormation ruleset
Updated over 1 year ago