KMS Keys Should Not Be Exposed
More Info:
Any publicly accessible AWS Key Management Service master keys should be identified and their access policy should be updated in order to stop any unsigned requests made to these resources.Risk Level
HighAddress
SecurityCompliance Standards
AWSWAF, PCIDSS, GDPRTriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step by step instructions to remediate this misconfiguration in AWS using the AWS console:
- Log in to the AWS Management Console.
- Go to the AWS KMS console.
- Click on the “Aliases” tab.
- Select the KMS key that is exposed.
- Click on the “Key Policy” button.
- Review the Key Policy to ensure that it is not exposing the KMS key.
- If the Key Policy is exposing the KMS key, click on the “Edit” button.
- Update the Key Policy to remove any permissions that expose the KMS key.
- Click on the “Review and Save” button.
- Review the changes made to the Key Policy.
- Click on the “Save Changes” button to save the updated Key Policy.
Using CLI
Using CLI
To remediate the issue of KMS Keys being exposed in AWS, you can follow the below steps using AWS CLI:Replace Replace
- List all the KMS keys in your AWS account by running the following command:
- Identify the KMS key(s) that are exposed and note down their Key IDs.
- Remove the Key Policy from the KMS key(s) by running the following command:
<key-id> with the Key ID of the KMS key that you want to remediate.- Verify that the Key Policy has been removed by running the following command:
<key-id> with the Key ID of the KMS key that you remediated. This command should return an empty policy.- Repeat steps 3 and 4 for all the exposed KMS keys in your AWS account.
Using Python
Using Python
To remediate the issue of KMS Keys being exposed in AWS using Python, you can follow the below steps:Step 1: Identify the KMS keys that are exposed.You can use the AWS CLI command Step 3: Monitor the KMS keys to ensure they are not exposed again.You can set up CloudWatch alarms to monitor the KMS keys and get notified if any of them are exposed again. You can also use AWS Config to monitor the KMS keys and get notified if any of the key policies are changed.
aws kms list-keys to list all the KMS keys in your AWS account. Then, you can use the aws kms describe-key command to get the details of each key and check if any of them are exposed.Step 2: Revoke the key policy that is exposing the KMS key.You can use the aws kms put-key-policy command to revoke the key policy that is exposing the KMS key. Here’s an example of how you can do it: