Ensure principal is defined for every IAM policy attached to AWS Key Management Service (KMS) key

HIGH

Description

Setting a Principal in an access policy will effectively grant users, accounts, or services with access to each repository. For more information on how to properly assign a Principal within the KMS policy, see the AWS documentation.
References:
https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html

Remediation

In AWS Console -

  1. Sign in to the AWS Console and open the KMS Console.
  2. Under Customer managed keys, choose the key you wish to edit.
  3. Under Key policy, choose Switch to policy view, then select edit.
  4. Configure the policy accordingly.
  5. Select Save changes.

In Terraform -

  1. In the aws_kms_key resource, configure the policy accordingly with a properly defined Principal.

References:
https://docs.aws.amazon.com/kms/latest/developerguide/security-iam.html
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key

Policy Details

Rule Reference ID: AC_AWS_0458
CSP: AWS
Remediation Available: Yes
Resource: aws_kms_key
Resource Category: Management

Frameworks