​
Event Information

  • The ListGrants event in AWS Key Management Service (KMS) refers to an action that lists the grants for a specified customer master key (CMK).
  • This event is triggered when a user or application requests to view the grants associated with a particular CMK in AWS KMS.
  • The ListGrants event provides visibility into the permissions and access control settings for the CMK, allowing administrators to monitor and audit the grants assigned to the key.

​
Examples

  1. Unauthorized access to sensitive data: If security is impacted with ListGrants in AWS Key Management Service (KMS), it could potentially allow unauthorized users to list the grants associated with a KMS key. This could lead to the exposure of sensitive information, such as the identities of users or roles that have access to the key, and the permissions granted to them.

  2. Increased risk of privilege escalation: ListGrants provides information about the grants on a KMS key, including the permissions granted to different entities. If security is compromised, an attacker could potentially use this information to identify and exploit vulnerabilities in the access control mechanisms. This could result in privilege escalation, allowing the attacker to gain unauthorized access to sensitive data or perform malicious actions.

  3. Breach of compliance requirements: ListGrants in KMS is often used to audit and monitor access to encryption keys, ensuring compliance with regulatory standards and data protection requirements. If security is impacted, it could lead to a breach of compliance requirements, such as the unauthorized disclosure of sensitive data or failure to meet access control standards. This could result in legal and financial consequences for the organization.

​
Remediation

​
Using Console

  1. Identify the affected AWS KMS key:

    • Log in to the AWS Management Console.
    • Go to the AWS KMS service.
    • Navigate to the “Customer managed keys” section.
    • Look for the key mentioned in the previous response.

  2. Update key policy to restrict access:

    • Select the key and click on “Key policy” tab.
    • Review the existing key policy and identify the necessary changes based on the examples provided.
    • Click on “Edit” and modify the key policy accordingly.
    • Ensure that only authorized IAM users or roles have the necessary permissions.
    • Save the changes to update the key policy.

  3. Monitor and review key usage:

    • Enable AWS CloudTrail to capture API calls related to the KMS key.
    • Set up CloudWatch alarms to notify any suspicious or unauthorized key usage.
    • Regularly review the CloudTrail logs and CloudWatch alarms to identify any potential security issues.
    • Take necessary actions to investigate and remediate any unauthorized access or suspicious activities.

Note: It is important to thoroughly understand the existing key policy and the specific requirements of your organization before making any changes. It is recommended to test the changes in a non-production environment before applying them to production keys.

​
Using CLI

To remediate issues related to AWS Key Management Service (KMS) using AWS CLI, you can follow these steps:

  1. Rotate KMS keys:

    • Identify the KMS key(s) that need to be rotated.
    • Generate a new key using the create-key command: aws kms create-key.
    • Update the necessary resources to use the new key.
    • Schedule the deletion of the old key using the schedule-key-deletion command: aws kms schedule-key-deletion --key-id <old-key-id> --pending-window-in-days <number-of-days>.
    • Monitor the key rotation process and ensure that all resources are successfully using the new key.

  2. Enable KMS key rotation:

    • Check if key rotation is already enabled for a specific KMS key using the get-key-rotation-status command: aws kms get-key-rotation-status --key-id <key-id>.
    • If key rotation is not enabled, enable it using the enable-key-rotation command: aws kms enable-key-rotation --key-id <key-id>.

  3. Monitor KMS key usage:

    • Enable CloudTrail logging for KMS API calls to monitor key usage and detect any suspicious activities.
    • Use the list-key-aliases command to list all key aliases: aws kms list-key-aliases.
    • Review the key usage patterns and access policies regularly to ensure compliance with security best practices.

Please note that the commands provided are examples and may need to be modified based on your specific requirements and environment.

​
Using Python

To remediate the issues related to AWS KMS using Python, you can follow these steps:

  1. Enable AWS CloudTrail for KMS:
    • Use the boto3 library to create a new CloudTrail trail for KMS.
    • Set the appropriate parameters such as the S3 bucket to store the logs and the KMS key to encrypt the logs.
    • Enable logging for KMS API events by specifying the appropriate event selectors.
import boto3

def enable_cloudtrail_kms():
    client = boto3.client('cloudtrail')
    
    response = client.create_trail(
        Name='kms-trail',
        S3BucketName='your-s3-bucket',
        KmsKeyId='your-kms-key-id',
        IsMultiRegionTrail=True
    )
    
    response = client.update_trail(
        Name='kms-trail',
        EventSelectors=[
            {
                'ReadWriteType': 'All',
                'IncludeManagementEvents': True,
                'DataResources': [
                    {
                        'Type': 'AWS::KMS::Key',
                        'Values': ['*']
                    }
                ]
            }
        ]
    )
  1. Enable AWS Config for KMS:
    • Use the boto3 library to create a new AWS Config rule for KMS.
    • Specify the rule parameters such as the required KMS key tags and the desired compliance level.
import boto3

def enable_aws_config_kms():
    client = boto3.client('config')
    
    response = client.put_config_rule(
        ConfigRule={
            'ConfigRuleName': 'kms-key-tags',
            'Description': 'Enforce required tags on KMS keys',
            'Scope': {
                'ComplianceResourceTypes': [
                    'AWS::KMS::Key'
                ]
            },
            'Source': {
                'Owner': 'AWS',
                'SourceIdentifier': 'KMS_KEY_TAGS'
            },
            'InputParameters': '{"requiredTags": ["tag1", "tag2"]}',
            'MaximumExecutionFrequency': 'TwentyFour_Hours'
        }
    )
  1. Enable AWS Security Hub for KMS:
    • Use the boto3 library to enable AWS Security Hub for KMS.
    • Specify the appropriate product ARN for KMS.
import boto3

def enable_security_hub_kms():
    client = boto3.client('securityhub')
    
    response = client.batch_enable_standards(
        StandardsSubscriptionRequests=[
            {
                'StandardsArn': 'arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0',
                'ProductArn': 'arn:aws:securityhub:us-west-2:123456789012:product/aws/securityhub'
            }
        ]
    )

Please note that you need to have the necessary permissions and credentials set up to execute these scripts successfully.