Project: KICS (Provisioning / Security & Compliance)
File: 2844c749-bd78-4cd1-90e8-b179df827602.md

title: CMK Is Unusable hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2844c749-bd78-4cd1-90e8-b179df827602 Query name: CMK Is Unusable Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Availability URL: AWS Key Management Service (KMS) must only possess usable Customer Master Keys (CMK), which means the CMKs must have the attribute 'Enabled' set to true and the attribute 'PendingWindowInDays' must be undefined.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6 31" Resources: myKey: Type: AWS::KMS::Key Properties: Enabled: false KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: Fn::Join: '' - 'arn:aws:iam::' Ref: AWS::AccountId :root Action: kms:* Resource: '*' Tags: Key: Ref: Key Value: Ref: Value myKey2: Type: AWS::KMS::Key Properties: Enabled: true PendingWindowInDays: 7 KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: Fn::Join: '' - 'arn:aws:iam::' Ref: AWS::AccountId :root Action: kms:* Resource: '*' Tags: Key: Ref: Key Value: Ref: Value Parameters: Key: Type: String Value: Type: String ``` ```json title="Positive test num. 2 - json file" hl_lines="59 6" { "Resources": { "myKey": { "Type": "AWS::KMS::Key", "Properties": { "Enabled": false, "KeyPolicy": { "Id": "key-default-1", "Statement": [ { "Resource": "*", "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Action": "kms:*" } ], "Version": "2012-10-17" }, "Tags": [ { "Key": { "Ref": "Key" }, "Value": { "Ref": "Value" } } ] } }, "myKey2": { "Type": "AWS::KMS::Key", "Properties": { "Tags": [ { "Key": { "Ref": "Key" }, "Value": { "Ref": "Value" } } ], "Enabled": true, "PendingWindowInDays": 7, "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Action": "kms:*", "Resource": "*" } ] } } }, "Parameters": { "Key": { "Type": "String" }, "Value": { "Type": "String" } } } } ``` ```yaml title="Negative test num. 1 - yaml file" Resources: myKey: Type: AWS::KMS::Key Properties: Enabled: true KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: Fn::Join: '' - 'arn:aws:iam::' Ref: AWS::AccountId :root Action: kms:* Resource: '*' Tags: Key: Ref: Key Value: Ref: Value Parameters: Key: Type: String Value: Type: String ``` ```json title="Negative test num. 2 - json file" { "Resources": { "myKey": { "Type": "AWS::KMS::Key", "Properties": { "Enabled": true, "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": { "Fn::Join": [ "", [ "arn:aws:iam::", { "Ref": "AWS::AccountId" }, ":root" ] ] } }, "Action": "kms:*", "Resource": "*" } ] }, "Tags": [ { "Key": { "Ref": "Key" }, "Value": { "Ref": "Value" } } ] } } }, "Parameters": { "Key": { "Type": "String" }, "Value": { "Type": "String" } } } ```