Detections
Analytics

Ensure that access policy is updated for AWS Key Management Service (KMS) key

HIGH

Description

A proper access policy should be configured for the KMS keys so that only necessary individuals have access. This should follow the policy of least privilege.

Remediation

In AWS Console -

  1. Sign in to the AWS Console and open the KMS Console.
  2. Under Customer managed keys, choose the key you wish to edit.
  3. Under Key policy, choose Switch to policy view, then select edit.
  4. Configure the policy accordingly.
  5. Select Save changes.

In Terraform -

  1. In the aws_kms_key resource, configure the policy accordingly.

References:
https://docs.aws.amazon.com/kms/latest/developerguide/security-iam.html
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key

Policy Details

Rule Reference ID: AC_AWS_0162
CSP: AWS
Remediation Available: Yes
Domain: Identity and Access Management
Resource: aws_kms_key
Resource Category: Management
Resource Type: Key Management Service (KMS)

Frameworks