Blocked KMS Actions In IAM Policies Should Be Set
More Info:
This rule checks if the managed AWS Identity and Access Management (IAM) policies that you create do not allow blocked actions on AWS Key Management Service (KMS) keys. The rule is NON_COMPLIANT if any blocked action is allowed on AWS KMS keys by the managed IAM policy. Note that this rule does not evaluate the conditions provided in IAM policies.Risk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
How to Prevent
Using Console
Using Console
To prevent blocked KMS actions in IAM policies using the AWS Management Console, follow these steps:
-
Navigate to IAM Policies:
- Open the AWS Management Console.
- In the navigation pane, choose “Policies” under the “Access management” section.
-
Create or Edit a Policy:
- To create a new policy, click on the “Create policy” button.
- To edit an existing policy, find the policy you want to modify and click on its name, then click the “Edit policy” button.
-
Add KMS Permissions:
- In the policy editor, switch to the “JSON” tab.
- Ensure that the policy includes the necessary KMS actions (e.g.,
kms:Encrypt,kms:Decrypt,kms:GenerateDataKey) and does not include any actions that should be blocked. - Example JSON snippet:
-
Review and Save:
- After adding the necessary permissions, click on the “Review policy” button.
- Provide a name and description for the policy if creating a new one.
- Click on the “Create policy” or “Save changes” button to apply the policy.
Using CLI
Using CLI
To prevent blocked KMS actions in IAM policies using AWS CLI, you need to ensure that your IAM policies are correctly configured to allow necessary KMS actions and deny any inappropriate ones. Here are the steps to achieve this:
-
Create a JSON Policy Document:
- First, create a JSON policy document that specifies the allowed and denied KMS actions. Save this document locally, for example, as
kms_policy.json.
- First, create a JSON policy document that specifies the allowed and denied KMS actions. Save this document locally, for example, as
-
Create or Update the IAM Policy:
- Use the AWS CLI to create a new IAM policy or update an existing one with the JSON policy document.
If you need to update an existing policy, use: -
Attach the Policy to IAM Users, Groups, or Roles:
- Attach the newly created or updated policy to the relevant IAM users, groups, or roles.
Similarly, for groups or roles: -
Verify the Policy Attachment:
- Verify that the policy has been correctly attached to the IAM users, groups, or roles.
Similarly, for groups or roles:
Using Python
Using Python
To prevent blocked KMS actions in IAM policies using Python scripts, you can use the AWS SDK for Python (Boto3). Here are the steps to ensure that KMS actions are properly set in IAM policies:
-
Install Boto3:
Ensure you have Boto3 installed in your Python environment. You can install it using pip if you haven’t already:
-
Initialize Boto3 Client:
Initialize the Boto3 client for IAM and KMS.
-
Retrieve and Update IAM Policies:
Retrieve the IAM policies and check for KMS actions. If they are not set correctly, update the policy.
-
Validate the Changes:
Ensure that the changes have been applied correctly by validating the updated policies.