AWS KMS Key policy overly permissive misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_33
Category - Subcategory	IAM - Overly Permissive
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Serverless, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	1867d4c1-87ed-4ed1-a11e-f88a1ca9ead7

Impact

This rule identifies KMS Keys that have a key policy overly permissive. Key policies are the primary way to control access to customer master keys (CMKs) in AWS KMS. It is recommended to follow the principle of least privilege ensuring that KMS key policy does not have all the permissions to be able to complete a malicious action.

For more details: https://docs.aws.amazon.com/kms/latest/developerguide/control-access-overview.html#overview-policy-elements

How to Fix

To fix this issue, ensure that the KMS key policy does not use wildcard (*) principals. Instead, specify specific AWS accounts or roles. [source,go]

Type: AWS::KMS::Key Properties: ... Statement:

• ... Principal:
• "*"
• AWS: "*"
• AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'

---