Blocked KMS Actions In Inline Policies Should Be Set
More Info:
This rule checks if the inline policies attached to your IAM roles do not allow blocked actions on all AWS Key Management Service (KMS) keys. The rule is NON_COMPLIANT if any blocked action is allowed on all AWS KMS keys in an inline policy.Risk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
How to Prevent
Using Console
Using Console
To prevent blocked KMS actions in inline policies in IAM using the AWS Management Console, follow these steps:
-
Navigate to IAM Policies:
- Open the AWS Management Console.
- In the navigation pane, choose “Policies” under the “Access management” section.
-
Create or Edit a Policy:
- To create a new policy, click on the “Create policy” button.
- To edit an existing policy, find the policy you want to modify and click on its name, then click the “Edit policy” button.
-
Specify KMS Actions:
- In the policy editor, switch to the “JSON” tab.
- Ensure that the policy explicitly specifies the allowed KMS actions. For example:
-
Review and Save:
- After specifying the allowed KMS actions, click on the “Review policy” button.
- Provide a name and description for the policy if creating a new one.
- Click on the “Create policy” or “Save changes” button to apply the policy.
Using CLI
Using CLI
To prevent blocked KMS actions in inline policies in IAM using AWS CLI, you can follow these steps:
-
Create a JSON Policy Document:
- First, create a JSON file that defines the inline policy with the necessary permissions and explicitly denies the blocked KMS actions.
- Example JSON policy (
policy.json):
-
Attach the Inline Policy to an IAM User:
- Use the
put-user-policycommand to attach the inline policy to a specific IAM user. - Command:
- Use the
-
Attach the Inline Policy to an IAM Group:
- Use the
put-group-policycommand to attach the inline policy to a specific IAM group. - Command:
- Use the
-
Attach the Inline Policy to an IAM Role:
- Use the
put-role-policycommand to attach the inline policy to a specific IAM role. - Command:
- Use the
Using Python
Using Python
To prevent blocked KMS actions in inline policies in IAM using Python scripts, you can use the AWS SDK for Python (Boto3). Here are the steps to achieve this:
Step 1: Install Boto3
Ensure you have Boto3 installed in your Python environment. You can install it using pip if you haven’t already:Step 2: Initialize Boto3 Client
Initialize the Boto3 client for IAM:Step 3: Define the Inline Policy
Create a JSON structure for the inline policy that blocks specific KMS actions. For example, you can block thekms:Decrypt action:Step 4: Attach the Inline Policy to an IAM User or Role
Attach the inline policy to a specific IAM user or role. Here’s an example of attaching it to a user:Full Script Example
Here is the complete script combining all the steps:Summary
- Install Boto3: Ensure Boto3 is installed in your Python environment.
- Initialize Boto3 Client: Set up the IAM client using Boto3.
- Define the Inline Policy: Create a JSON structure for the inline policy to block specific KMS actions.
- Attach the Inline Policy: Use the
put_user_policymethod to attach the policy to an IAM user.