> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Blocked KMS Actions In Inline Policies Should Be Set ### More Info: This rule checks if the inline policies attached to your IAM groups do not allow blocked actions on all AWS Key Management Service (KMS) keys. The rule is NON\_COMPLIANT if any blocked action is allowed on all AWS KMS keys in an inline policy. ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### How to Prevent To prevent blocked KMS actions in inline policies in IAM using the AWS Management Console, follow these steps: 1. **Navigate to IAM Policies:** * Open the AWS Management Console. * In the navigation pane, choose "Policies" under the "Access management" section. 2. **Create or Edit a Policy:** * To create a new policy, click on the "Create policy" button. * To edit an existing policy, find the policy you want to modify and click on its name, then click the "Edit policy" button. 3. **Specify KMS Actions:** * In the policy editor, switch to the "JSON" tab. * Ensure that the policy explicitly specifies the allowed KMS actions. For example: ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*" } ] } ``` 4. **Review and Save:** * After specifying the allowed KMS actions, click on the "Review policy" button. * Provide a name and description for the policy if creating a new one. * Click on the "Create policy" or "Save changes" button to apply the policy. By following these steps, you ensure that the inline policies in IAM explicitly allow the necessary KMS actions, preventing any misconfigurations related to blocked KMS actions. To prevent blocked KMS actions in inline policies in IAM using AWS CLI, you can follow these steps: 1. **Create a JSON Policy Document**: * First, create a JSON file that defines the inline policy with the necessary permissions and explicitly denies the blocked KMS actions. * Example JSON policy (`policy.json`): ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*" }, { "Effect": "Deny", "Action": [ "kms:DisableKey", "kms:ScheduleKeyDeletion" ], "Resource": "*" } ] } ``` 2. **Attach the Inline Policy to an IAM User**: * Use the `put-user-policy` command to attach the inline policy to a specific IAM user. * Command: ```sh theme={null} aws iam put-user-policy --user-name --policy-name --policy-document file://policy.json ``` 3. **Attach the Inline Policy to an IAM Group**: * Use the `put-group-policy` command to attach the inline policy to a specific IAM group. * Command: ```sh theme={null} aws iam put-group-policy --group-name --policy-name --policy-document file://policy.json ``` 4. **Attach the Inline Policy to an IAM Role**: * Use the `put-role-policy` command to attach the inline policy to a specific IAM role. * Command: ```sh theme={null} aws iam put-role-policy --role-name --policy-name --policy-document file://policy.json ``` By following these steps, you can ensure that the necessary KMS actions are allowed while explicitly denying the blocked KMS actions in inline policies using AWS CLI. To prevent blocked KMS actions in inline policies in IAM using Python scripts, you can use the AWS SDK for Python (Boto3). Here are the steps to achieve this: ### Step 1: Install Boto3 Ensure you have Boto3 installed in your Python environment. You can install it using pip if you haven't already: ```bash theme={null} pip install boto3 ``` ### Step 2: Initialize Boto3 Client Initialize the Boto3 client for IAM: ```python theme={null} import boto3 iam_client = boto3.client('iam') ``` ### Step 3: Define the Inline Policy Create a JSON structure for the inline policy that blocks specific KMS actions. For example, you can block the `kms:Decrypt` action: ```python theme={null} inline_policy = { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "kms:Decrypt" ], "Resource": "*" } ] } ``` ### Step 4: Attach the Inline Policy to an IAM User or Role Attach the inline policy to a specific IAM user or role. Here’s an example of attaching it to a user: ```python theme={null} user_name = 'your-iam-user-name' policy_name = 'BlockKMSActionsPolicy' response = iam_client.put_user_policy( UserName=user_name, PolicyName=policy_name, PolicyDocument=json.dumps(inline_policy) ) print(f"Policy {policy_name} attached to user {user_name}") ``` ### Full Script Example Here is the complete script combining all the steps: ```python theme={null} import boto3 import json # Initialize Boto3 client iam_client = boto3.client('iam') # Define the inline policy inline_policy = { "Version": "2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "kms:Decrypt" ], "Resource": "*" } ] } # Attach the inline policy to an IAM user user_name = 'your-iam-user-name' policy_name = 'BlockKMSActionsPolicy' response = iam_client.put_user_policy( UserName=user_name, PolicyName=policy_name, PolicyDocument=json.dumps(inline_policy) ) print(f"Policy {policy_name} attached to user {user_name}") ``` ### Summary 1. **Install Boto3**: Ensure Boto3 is installed in your Python environment. 2. **Initialize Boto3 Client**: Set up the IAM client using Boto3. 3. **Define the Inline Policy**: Create a JSON structure for the inline policy to block specific KMS actions. 4. **Attach the Inline Policy**: Use the `put_user_policy` method to attach the policy to an IAM user. By following these steps, you can prevent blocked KMS actions in inline policies using Python scripts. ### Check Cause 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 2. In the navigation pane, choose "Policies". This will open a list of all the IAM policies that are currently configured in your AWS environment. 3. Select the policy you want to check for blocked KMS actions. This will open the policy details page. 4. In the policy details page, check the policy document for any "Deny" statements that are applied to KMS actions. If there are any "Deny" statements applied to KMS actions, then the policy is blocking those actions. 1. First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to execute IAM related commands. 2. Once the AWS CLI is set up, you can list all the IAM policies using the following command: ``` aws iam list-policies --scope Local ``` This command will return a list of all the IAM policies that are created within your AWS account. 3. For each policy, you can get the policy details including the policy document by using the following command: ``` aws iam get-policy-version --policy-arn --version-id ``` Replace `` with the ARN of the policy and `` with the version ID of the policy. This command will return the policy document which includes the permissions set by the policy. 4. Now, you need to check the policy document for any blocked KMS actions. You can do this by looking for "kms:Deny" statements in the policy document. If you find any such statements, it means that some KMS actions are blocked in the inline policy. You can use a JSON parser or a script to automate this process. For example, in Python, you can use the `json` module to parse the policy document and check for blocked KMS actions. 1. Install and configure AWS SDK for Python (Boto3): You need to install and configure Boto3 to interact with AWS services. You can install it using pip: ``` pip install boto3 ``` Then, configure your AWS credentials either by setting the following environment variables: ``` AWS_ACCESS_KEY_ID = 'your_access_key' AWS_SECRET_ACCESS_KEY = 'your_secret_key' ``` Or, you can create the credential file yourself at \~/.aws/credentials. At a minimum, it should look like this: ``` [default] aws_access_key_id = YOUR_ACCESS_KEY aws_secret_access_key = YOUR_SECRET_KEY ``` 2. Use Boto3 to list all IAM policies: You can use the `list_policies` method to retrieve all IAM policies. Here is a sample script: ```python theme={null} import boto3 # Create IAM client iam = boto3.client('iam') # List policies response = iam.list_policies(Scope='All') for policy in response['Policies']: print(policy['PolicyName']) ``` 3. Get the policy details: For each policy, you can use the `get_policy` method to retrieve the policy details, including the policy document. Here is a sample script: ```python theme={null} import boto3 # Create IAM client iam = boto3.client('iam') # Get policy response = iam.get_policy(PolicyArn='arn:aws:iam::aws:policy/AdministratorAccess') policy_document = response['Policy']['PolicyDocument'] print(policy_document) ``` 4. Check for blocked KMS actions: You can parse the policy document to check if it contains any blocked KMS actions. Here is a sample script: ```python theme={null} import boto3 import json # Create IAM client iam = boto3.client('iam') # Get policy response = iam.get_policy(PolicyArn='arn:aws:iam::aws:policy/AdministratorAccess') policy_document = response['Policy']['PolicyDocument'] # Parse policy document policy_document = json.loads(policy_document) # Check for blocked KMS actions for statement in policy_document['Statement']: if 'kms:Decrypt' in statement['Action'] and statement['Effect'] == 'Deny': print('Blocked KMS action found: kms:Decrypt') ``` This script checks if the 'kms:Decrypt' action is blocked. You can modify it to check for other KMS actions. ### Remediation To remediate the issue of blocked KMS actions in inline policies for AWS IAM using the AWS Management Console, you can follow these steps: 1. **Identify the Inline Policy**: First, you need to identify the IAM user, group, or role that has the inline policy with blocked KMS actions. 2. **Access the IAM Console**: Log in to the AWS Management Console and navigate to the IAM service. 3. **Locate the User, Group, or Role**: In the IAM console, locate and select the IAM user, group, or role that has the inline policy with blocked KMS actions. 4. **Edit Inline Policy**: Within the user, group, or role details page, locate the inline policy that contains the blocked KMS actions. 5. **Update the Policy**: Edit the inline policy to allow the necessary KMS actions that were previously blocked. You can do this by adding the required permissions to the policy document. 6. **Review and Save Changes**: After updating the policy document to allow the required KMS actions, review the changes to ensure they are correct. Once you are satisfied, save the changes to update the inline policy. 7. **Verify Permissions**: Test the permissions by attempting to perform the KMS actions that were previously blocked. Ensure that the user, group, or role can now successfully perform these actions. 8. **Monitor for Compliance**: Regularly monitor the IAM policies to ensure that blocked KMS actions are not reintroduced and that all necessary permissions are correctly configured. By following these steps, you can successfully remediate the issue of blocked KMS actions in inline policies for AWS IAM using the AWS Management Console. # To remediate the issue of blocked KMS actions in inline policies for AWS IAM using AWS CLI, follow these step-by-step instructions: 1. Identify the inline policy attached to the IAM user, group, or role that contains blocked KMS actions. You can use the following AWS CLI command to list all the inline policies attached to the IAM entity: ```bash theme={null} aws iam list-user-policies --user-name aws iam list-group-policies --group-name aws iam list-role-policies --role-name ``` Replace ``, ``, or `` with the appropriate IAM entity name. 2. Once you have identified the inline policy that contains blocked KMS actions, you need to edit the policy document to allow the necessary KMS actions. You can use the following AWS CLI command to get the policy document for the inline policy: ```bash theme={null} aws iam get-user-policy --user-name --policy-name aws iam get-group-policy --group-name --policy-name aws iam get-role-policy --role-name --policy-name ``` Replace ``, ``, ``, and `` with the appropriate values. 3. Edit the policy document to allow the necessary KMS actions. You can use a text editor to modify the policy document and add the required KMS actions. 4. Once you have updated the policy document, you can use the following AWS CLI command to update the inline policy with the new policy document: ```bash theme={null} aws iam put-user-policy --user-name --policy-name --policy-document file:// aws iam put-group-policy --group-name --policy-name --policy-document file:// aws iam put-role-policy --role-name --policy-name --policy-document file:// ``` Replace ``, ``, ``, ``, and `` with the appropriate values. 5. Verify that the inline policy has been updated successfully by listing the inline policies again and checking the policy document. By following these steps, you can remediate the issue of blocked KMS actions in inline policies for AWS IAM using AWS CLI. To remediate the misconfiguration of blocked KMS actions in inline policies in AWS IAM using Python, you can follow these steps: 1. Identify the IAM user, group, or role that has the inline policy with blocked KMS actions. 2. Update the inline policy to allow the necessary KMS actions. 3. Use the AWS SDK for Python (Boto3) to programmatically update the inline policy. Here is an example Python script to remediate this misconfiguration: ```python theme={null} import boto3 # Define the IAM entity (user, group, role) and the inline policy with blocked KMS actions entity_name = 'your-entity-name' policy_name = 'your-inline-policy-name' blocked_actions = ['kms:Encrypt', 'kms:Decrypt'] # Add any other blocked KMS actions # Initialize the IAM client iam = boto3.client('iam') # Get the inline policy document policy_document = { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "*", "Resource": "*" } ] } # Update the inline policy to allow all KMS actions response = iam.put_user_policy( UserName=entity_name, PolicyName=policy_name, PolicyDocument=json.dumps(policy_document) ) # Check if the policy update was successful if response['ResponseMetadata']['HTTPStatusCode'] == 200: print(f"Successfully updated inline policy for {entity_name} to allow all KMS actions.") else: print("Failed to update inline policy.") ``` Make sure to replace `'your-entity-name'` and `'your-inline-policy-name'` with the actual IAM entity name and inline policy name that need to be remediated. Also, update the `blocked_actions` list with the specific KMS actions that were previously blocked. By running this script, you can programmatically update the inline policy to allow all KMS actions and remediate the misconfiguration of blocked KMS actions in AWS IAM. ```hcl theme={null} # IAM group inline policy with restricted KMS resource instead of "*" resource "aws_iam_group" "example" { name = "IAM_GROUP_NAME" # replace with your IAM group name } resource "aws_iam_group_policy" "restricted_kms" { name = "INLINE_POLICY_NAME" # replace with your inline policy name group = aws_iam_group.example.name policy = jsonencode({ Version = "2012-10-17" Statement = [ { Sid = "AllowSpecificKMSUsage" Effect = "Allow" Action = [ "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:DescribeKey" ] # IMPORTANT: Do NOT use "*" here. # Replace with the specific KMS key ARN(s) you intend to allow. Resource = "arn:aws:kms:AWS_REGION:ACCOUNT_ID:key/YOUR_KEY_ID" # - Replace AWS_REGION with the region (e.g., us-east-1) # - Replace ACCOUNT_ID with your AWS account ID # - Replace YOUR_KEY_ID with the KMS key ID or key ARN suffix } ] }) } ``` This mirrors the CLI remediation by changing the inline policy so that any KMS actions are scoped to specific KMS key ARN(s) instead of `"Resource": "*"`. Updating the `policy` JSON is an in‑place change; it does not force replacement of the IAM group or the policy resource, but an incorrect policy can disrupt application functionality, so test in non‑production first. To verify, `terraform plan` should show an in‑place update on `aws_iam_group_policy.restricted_kms` with the `policy` JSON changing from a `"Resource": "*"` entry for KMS actions to the specific KMS key ARN you configured. ### Additional Reading: * [https://docs.aws.amazon.com/config/latest/developerguide/iam-inline-policy-blocked-kms-actions.html](https://docs.aws.amazon.com/config/latest/developerguide/iam-inline-policy-blocked-kms-actions.html)