turbot/aws_compliance
Loading controls...

Control: KMS key decryption should be restricted in IAM inline policy

Description

Checks whether the inline policies that are embedded in your IAM identities (role, user, or group) allow the AWS KMS decryption actions on all KMS keys. This control uses Zelkova, an automated reasoning engine, to validate and warn you about policies that may grant broad access to your secrets across AWS accounts. This control fails if kms:Decrypt or kms:ReEncryptFrom actions are allowed on all KMS keys in an inline policy.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.kms_key_decryption_restricted_in_iam_inline_policy

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.kms_key_decryption_restricted_in_iam_inline_policy --share

SQL

This control uses a named query:

kms_key_decryption_restricted_in_iam_inline_policy

Tags