Skip to main content

๐Ÿ›ก๏ธ AWS IAM Group Inline Policy allows KMS decryption actions on all KMS keys๐ŸŸข

  • Contextual name: ๐Ÿ›ก๏ธ Group Inline Policy allows KMS decryption actions on all KMS keys๐ŸŸข
  • ID: /ce/ca/aws/iam/group-inline-policy-allows-kms-decrypt-on-all-keys
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: SECURITY

Logicโ€‹

Similar Policiesโ€‹

Descriptionโ€‹

Open File

Descriptionโ€‹

This policy checks whether an IAM group inline policy allows KMS decryption actions on all AWS KMS keys.

Rationaleโ€‹

IAM group inline policies should follow least privilege and grant access only to the KMS keys that group members explicitly require.

If a group inline policy allows kms:Decrypt, kms:ReEncryptFrom, or broader KMS decryption-related actions against * or wildcard KMS key ARNs, every principal that inherits the policy through the group can potentially decrypt data protected by keys outside its intended boundary. This increases the blast radius of policy misconfiguration, privilege escalation, and credential misuse.

Impactโ€‹

Restricting wildcard KMS access can require updates to shared access models, delegated administration workflows, or legacy group-based permissions that currently rely on broad KMS access. Before tightening the policy, identify the exact KMS keys each group member needs and validate the updated access in a non-production environment when possible.

Auditโ€‹

This policy flags an AWS IAM Group Policy as INCOMPLIANT when all of the following are true:

... see more

Remediationโ€‹

Open File

Remediationโ€‹

Restrict KMS key scopeโ€‹

Perform the following to update the IAM group inline policy by replacing wildcard KMS resources with the specific KMS key ARNs that should be allowed and, where possible, narrowing broad KMS actions.

From Command Lineโ€‹

  1. Retrieve the current inline policy document:

    aws iam get-group-policy \
        --group-name {{group-name}} \
        --policy-name {{policy-name}}

  2. Update the policy document so that KMS decryption permissions are limited to only the specific KMS key ARNs that the group requires.

  3. Apply the updated inline policy:

    aws iam put-group-policy \
        --group-name {{group-name}} \
        --policy-name {{policy-name}} \
        --policy-document file://policy.json

Notesโ€‹

Grant kms:Decrypt and kms:ReEncryptFrom only for the KMS keys that the group inline policy should allow.

Where possible, also narrow the allowed actions so the policy does not rely on broad permissions such as kms:* or kms:ReEncrypt*.

policy.yamlโ€‹

Open File

Linked Framework Sectionsโ€‹

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
๐Ÿ’ผ AWS Foundational Security Best Practices v1.0.0 โ†’ ๐Ÿ’ผ [KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys3no data
๐Ÿ’ผ Cloudaware Framework โ†’ ๐Ÿ’ผ Role-Based Access Control (RBAC) Management28no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-2 Account Management (L)(M)(H)10858no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-2(1) Automated System Account Management (M)(H)32no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-3 Access Enforcement (L)(M)(H)3789no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-5 Separation of Duties (M)(H)22no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-6 Least Privilege (M)(H)81185no data
๐Ÿ’ผ FedRAMP High Security Controls โ†’ ๐Ÿ’ผ AC-6(3) Network Access to Privileged Commands (H)16no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ AC-2 Account Management (L)(M)(H)9no data
๐Ÿ’ผ FedRAMP Low Security Controls โ†’ ๐Ÿ’ผ AC-3 Access Enforcement (L)(M)(H)89no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-2 Account Management (L)(M)(H)958no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-2(1) Automated System Account Management (M)(H)32no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-3 Access Enforcement (L)(M)(H)89no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-5 Separation of Duties (M)(H)22no data
๐Ÿ’ผ FedRAMP Moderate Security Controls โ†’ ๐Ÿ’ผ AC-6 Least Privilege (M)(H)685no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ DE.CM-01: Networks and network services are monitored to find potentially adverse events185no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events105no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization47no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties138no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected190no data
๐Ÿ’ผ NIST CSF v2.0 โ†’ ๐Ÿ’ผ PR.IR-01: Networks and environments are protected from unauthorized logical access and usage128no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-2 Account Management132057no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-2(1) Account Management _ Automated System Account Management432no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-3 Access Enforcement15565no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-3(7) Access Enforcement _ Role-based Access Control36no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-3(15) Access Enforcement _ Discretionary and Mandatory Access Control27no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-5 Separation of Duties22no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-6 Least Privilege102378no data
๐Ÿ’ผ NIST SP 800-53 Revision 5 โ†’ ๐Ÿ’ผ AC-6(3) Least Privilege _ Network Access to Privileged Commands6no data