Skip to main content

๐Ÿ›ก๏ธ AWS IAM Customer Managed Policy allows KMS decryption actions on all KMS keys๐ŸŸข

  • Contextual name: ๐Ÿ›ก๏ธ Customer Managed Policy allows KMS decryption actions on all KMS keys๐ŸŸข
  • ID: /ce/ca/aws/iam/customer-managed-policy-allows-kms-decrypt-on-all-keys
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logicโ€‹

Similar Policiesโ€‹

Descriptionโ€‹

Open File

Descriptionโ€‹

This policy checks whether a customer managed IAM policy allows KMS decryption actions on all AWS KMS keys.

Rationaleโ€‹

Customer managed IAM policies should follow least privilege and grant access only to the KMS keys that a workload, service, or user explicitly requires.

If a customer managed policy allows kms:Decrypt, kms:ReEncryptFrom, or broader KMS decryption-related actions against * or wildcard KMS key ARNs, any principal that receives the policy can potentially decrypt data protected by keys outside its intended boundary. This increases the blast radius of credential misuse, policy misassignment, and privilege escalation.

Impactโ€‹

Restricting wildcard KMS access can require updates to applications, automation, or delegated administration workflows that currently rely on broad permissions. Before tightening the policy, identify the exact KMS keys each intended principal must use and validate the updated access in a non-production environment when possible.

Auditโ€‹

This policy flags an AWS IAM Policy as INCOMPLIANT when all of the following are true:

... see more

Remediationโ€‹

Open File

Remediationโ€‹

Restrict KMS key scopeโ€‹

Perform the following to update the customer managed IAM policy by replacing wildcard KMS resources with the specific KMS key ARNs that should be allowed and, where possible, narrowing broad KMS actions.

From Command Lineโ€‹

  1. Identify the policy and its default version:

    aws iam get-policy \
        --policy-arn {{policy-arn}}

  2. Retrieve the current policy document:

    aws iam get-policy-version \
        --policy-arn {{policy-arn}} \
        --version-id {{default-version-id}}

  3. Update the policy document so that KMS decryption permissions are limited to the specific KMS key ARNs that are required.

  4. Create a new policy version and set it as the default:

    aws iam create-policy-version \
        --policy-arn {{policy-arn}} \
        --policy-document file://policy.json \
        --set-as-default

  5. If the policy already has five versions, delete an older non-default version and then create the new version:

    aws iam delete-policy-version \

... see more

policy.yamlโ€‹

Open File

Linked Framework Sectionsโ€‹

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
๐Ÿ’ผ AWS Foundational Security Best Practices v1.0.0 โ†’ ๐Ÿ’ผ [KMS.1] IAM customer managed policies should not allow decryption actions on all KMS keys1no data
๐Ÿ’ผ Cloudaware Framework โ†’ ๐Ÿ’ผ Role-Based Access Control (RBAC) Management28no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-2 Account Management (L)(M)(H)10858no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-2(1) Automated System Account Management (M)(H)32no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-3 Access Enforcement (L)(M)(H)3789no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-5 Separation of Duties (M)(H)22no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-6 Least Privilege (M)(H)81185no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-6(3) Network Access to Privileged Commands (H)16no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ AC-2 Account Management (L)(M)(H)9no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ AC-3 Access Enforcement (L)(M)(H)89no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-2 Account Management (L)(M)(H)958no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-2(1) Automated System Account Management (M)(H)32no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-3 Access Enforcement (L)(M)(H)89no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-5 Separation of Duties (M)(H)22no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-6 Least Privilege (M)(H)685no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ DE.CM-01: Networks and network services are monitored to find potentially adverse events185no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events105no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization47no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties138no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected190no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.IR-01: Networks and environments are protected from unauthorized logical access and usage128no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-2 Account Management132057no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-2(1) Account Management _ Automated System Account Management432no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-3 Access Enforcement15565no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-3(7) Access Enforcement _ Role-based Access Control36no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-3(15) Access Enforcement _ Discretionary and Mandatory Access Control27no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-5 Separation of Duties22no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-6 Least Privilege102378no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-6(3) Least Privilege _ Network Access to Privileged Commands6no data