Project: KICS (Provisioning / Security & Compliance)
File: f6049677-ec4a-43af-8779-5190b6d03cba.md

title: KMS Allows Wildcard Principal hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f6049677-ec4a-43af-8779-5190b6d03cba Query name: KMS Allows Wildcard Principal Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: KMS Should not allow Principal parameter to be set as *<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8" AWSTemplateFormatVersion: 2010-09-09 Description: A sample template Resources: myKey: Type: AWS::KMS::Key Properties: Description: An example symmetric CMK KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: "*" Action: kms:* Resource: '*' Sid: Allow administration of the key Effect: Allow Principal: AWS: arn:aws:iam::123456789012:user/Alice Action: kms:Create* kms:Describe* kms:Enable* kms:List* kms:Put* kms:Update* kms:Revoke* kms:Disable* kms:Get* kms:Delete* kms:ScheduleKeyDeletion kms:CancelKeyDeletion Resource: '*' Sid: Allow use of the key Effect: Allow Principal: AWS: arn:aws:iam::123456789012:user/Bob Action: kms:DescribeKey kms:Encrypt kms:Decrypt kms:ReEncrypt* kms:GenerateDataKey kms:GenerateDataKeyWithoutPlaintext Resource: '*' ``` ```json title="Positive test num. 2 - json file" hl_lines="8" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "A sample template", "Resources": { "myKey": { "Properties": { "Description": "An example symmetric CMK", "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Resource": "*", "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": "*", "Action": "kms:*" }, { "Sid": "Allow administration of the key", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/Alice" }, "Action": [ "kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*", "kms:Put*", "kms:Update*", "kms:Revoke*", "kms:Disable*", "kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion" ], "Resource": "*" }, { "Sid": "Allow use of the key", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/Bob" }, "Action": [ "kms:DescribeKey", "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*" } ] } }, "Type": "AWS::KMS::Key" } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: 2010-09-09 Description: A sample template Resources: myKey: Type: AWS::KMS::Key Properties: Description: An example symmetric CMK KeyPolicy: Version: '2012-10-17' Id: key-default-1 Statement: Sid: Enable IAM User Permissions Effect: Allow Principal: AWS: arn:aws:iam::111122223333:root Action: kms:* Resource: '*' Sid: Allow administration of the key Effect: Allow Principal: AWS: arn:aws:iam::123456789012:user/Alice Action: kms:Create* kms:Describe* kms:Enable* kms:List* kms:Put* kms:Update* kms:Revoke* kms:Disable* kms:Get* kms:Delete* kms:ScheduleKeyDeletion kms:CancelKeyDeletion Resource: '*' Sid: Allow use of the key Effect: Allow Principal: AWS: arn:aws:iam::123456789012:user/Bob Action: kms:DescribeKey kms:Encrypt kms:Decrypt kms:ReEncrypt* kms:GenerateDataKey kms:GenerateDataKeyWithoutPlaintext Resource: '*' ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09T00:00:00Z", "Description": "A sample template", "Resources": { "myKey": { "Type": "AWS::KMS::Key", "Properties": { "Description": "An example symmetric CMK", "KeyPolicy": { "Version": "2012-10-17", "Id": "key-default-1", "Statement": [ { "Sid": "Enable IAM User Permissions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::111122223333:root" }, "Action": "kms:*", "Resource": "*" }, { "Sid": "Allow administration of the key", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/Alice" }, "Action": [ "kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*", "kms:Put*", "kms:Update*", "kms:Revoke*", "kms:Disable*", "kms:Get*", "kms:Delete*", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion" ], "Resource": "*" }, { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:user/Bob" }, "Action": [ "kms:DescribeKey", "kms:Encrypt", "kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlaintext" ], "Resource": "*", "Sid": "Allow use of the key" } ] } } } } } ```