KMS Keys Should Not Allow Unknown Cross Account Access
More Info:
All your AWS Key Management Service keys should be configured to be accessed only by trusted AWS accounts in order to protect against unauthorized cross account access. This will help prevent data breaches and loss.Risk Level
HighAddress
SecurityCompliance Standards
AWSWAFTriage and Remediation
Remediation
Using Console
Using Console
To remediate the KMS Keys Should Not Allow Unknown Cross Account Access misconfiguration for AWS using the AWS console, follow the below steps:
- Log in to the AWS Management Console.
- Go to the AWS Key Management Service (KMS) console.
- Click on the “Customer managed keys” link located in the left-hand menu.
- Select the KMS key that is not configured properly.
- Click on the “Key policy” tab.
- Click on the “Edit” button.
- In the “Principal” section, remove any unknown or unauthorized cross-account access.
- Add the appropriate AWS account IDs or IAM roles that should have access to the KMS key.
- Click on the “Review policy” button.
- Review the changes and ensure that they are correct.
- Click on the “Save changes” button.
- Verify that the KMS key is now properly configured by testing it with authorized access.
Using CLI
Using CLI
To remediate the misconfiguration “KMS Keys Should Not Allow Unknown Cross Account Access” in AWS using AWS CLI, follow the below steps:
-
Identify the KMS keys that allow unknown cross-account access:
-
Remove the unknown cross-account access from the KMS key policy:
-
Verify that the unknown cross-account access has been removed:
If there is no output, then the remediation is successful.
Using Python
Using Python
To remediate the misconfiguration “KMS Keys Should Not Allow Unknown Cross Account Access” for AWS using Python, you can follow these steps:Note: Replace the account ID
-
Identify the KMS keys that are allowing unknown cross-account access. You can do this by using the AWS CLI command
aws kms list-keysto get a list of all the KMS keys and then using theaws kms describe-keycommand to get the key policy for each key. -
Check the key policy to see if it allows unknown cross-account access. You can do this by looking for the
"AWS"field in thePrincipalelement of the policy. If the"AWS"field is set to"*"or does not include a specific account ID, then the key allows unknown cross-account access. -
Modify the key policy to remove the unknown cross-account access. You can do this by using the
aws kms put-key-policycommand to update the key policy. You will need to specify the key ID, the policy name, and the new policy document that removes the"AWS"field or replaces it with a specific account ID. -
Test the modified key policy to ensure that it no longer allows unknown cross-account access. You can do this by using the
aws kms encryptcommand to encrypt a test message using the modified key. If the encryption is successful, then the key policy has been remediated.
123456789012 with your own account ID.