KMS Key Policies Should Be Designed To Limit Number Of KMS Admins
More Info:
KMS key policies should be designed to limit the number of users who can perform encrypt and decrypt operations. Each application should use its own key to avoid over exposure.Risk Level
LowAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of KMS Key Policies should be designed to limit the number of KMS Admins in AWS, follow the below steps using AWS Console:
- Open the AWS KMS Console.
- From the left navigation pane, choose “Customer managed keys”.
- Select the KMS key for which you want to remediate the misconfiguration.
- In the Key policy section, choose “Edit”.
- Update the key policy to include only the required number of IAM users or roles who need administrative access to the KMS key.
- Remove any unnecessary IAM users or roles from the key policy.
- Choose “Review policy”.
- Review the policy changes and ensure that the policy is designed to limit the number of KMS admins.
- Choose “Save changes” to save the updated key policy.
- Verify that only the required IAM users or roles have administrative access to the KMS key.
Using CLI
Using CLI
To remediate this issue for AWS, you can follow these steps using AWS CLI:Identify the KMS key ID that needs to be remediated.Step 2: Create a new IAM policy that grants the required permissions for KMS key managementCreate a new IAM policy that grants the required permissions for KMS key management. Here’s an example of a policy that allows a user to manage a specific KMS key:Replace the KMS key ARN with the ARN of the KMS key that needs to be managed.Step 3: Attach the new IAM policy to an IAM user or role that needs to manage the KMS keyUse the following command to attach the new IAM policy to an IAM user or role:Replace Replace
- Identify the KMS key ID that needs to be remediated.
- Create a new IAM policy that grants the required permissions for KMS key management.
- Attach the new IAM policy to an IAM user or role that needs to manage the KMS key.
- Remove the KMS key administrator permissions from the existing IAM users or roles.
<user-name> with the name of the IAM user or role that needs to manage the KMS key, and <policy-arn> with the ARN of the new IAM policy.Step 4: Remove the KMS key administrator permissions from the existing IAM users or rolesUse the following command to remove the KMS key administrator permissions from the existing IAM users or roles:<key-id> with the ID of the KMS key, and <grant-id> with the ID of the grant that needs to be revoked.Repeat this command for each grant that needs to be revoked.By following these steps, you can remediate the misconfiguration of KMS key policies that should be designed to limit the number of KMS admins for AWS.Using Python
Using Python
To remediate this misconfiguration in AWS using Python, you can follow these steps:In the above code, you need to replace the
- First, you need to identify the KMS keys that have overly permissive key policies. You can use the
boto3library in Python to list all the KMS keys and their key policies.
- Once you have identified the KMS keys with overly permissive key policies, you need to update their policies to limit the number of KMS admins. You can use the
put_key_policymethod to update the key policy.
KeyId with the ID of the KMS key that you want to update, and replace the AWS ARNs with the ARNs of the IAM users who should have KMS admin permissions.- Repeat step 2 for all the KMS keys with overly permissive key policies.