Elastic medium stable kql

AWS KMS Key Policy Updated via PutKeyPolicy

Identifies successful PutKeyPolicy calls on AWS KMS keys. The key policy is a resource-based policy that controls which principals can use the key for cryptographic operations and administration. Adversaries with "kms:PutKeyPolicy" may add or broaden principals (including external accounts) to decrypt or exfiltrate data protected by the key, or to preserve access after other credentials are rotated. This is distinct from disabling or scheduling deletion of the key.

View Source

Detection Logic

event.dataset: "aws.cloudtrail"
    and event.provider: "kms.amazonaws.com"
    and event.action: "PutKeyPolicy"
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"
    and not user_agent.original: (*Terraform* or *Pulumi*)

False Positives

⚠ Security, platform, and encryption teams legitimately update KMS key policies during onboarding, key rotation, or cross-account access design. Review the policy document diff, ticketing, and whether new principals are in-org.

Field Validations

Loading…

Comments (0)

Loading comments...