Panther high experimental python

AWS KMS Key Restricts Usage

This policy validates that KMS Keys restrict what entities can use them and how. This is to ensure that encryption keys are limited in who can use them in order to prevent unapproved decryption.

View Source

Detection Logic

import json

from policyuniverse.policy import Policy

BAD_PRINCIPALS = {
    "*",
}

BAD_ACTIONS = {
    "*",
    "kms:*",
}


def policy(resource):
    if resource["Policy"] is None:
        return True

    iam_policy = Policy(json.loads(resource["Policy"]))

    for statement in iam_policy.statements:
        # Only apply to allow effects
        if statement.effect != "Allow":
            continue

        # Don't apply where there are strong conditions
        if statement.condition_entries:
            continue

        if BAD_PRINCIPALS.intersection(statement.principals) and BAD_ACTIONS.intersection(
            statement.actions
        ):
            return False
        if statement.uses_not_principal():
            return False

    return True

Field Validations

Loading…

Comments (0)

Loading comments...