Check ID: iam_inline_policy_no_full_access_to_kms
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: AwsIamPolicy

​
What this check verifies

IAM inline policies are analyzed to identify statements that grant unrestricted AWS KMS access via the wildcard action kms:*.

​
Risk

Granting kms:* enables decryption of protected data, modification of key policies and grants, and disabling or deleting keys. Impacts:
  • Confidentiality via unauthorized decryption
  • Integrity through key/grant tampering
  • Availability if keys are disabled or deleted, breaking encrypted workloads

​
Recommendation

Replace kms:* with least-privilege, action-scoped permissions limited to required operations and specific key ARNs. Enforce separation of duties for key admins vs users. Prefer managed policies over inline and apply guardrails (permissions boundaries/SCPs). Add conditions to constrain service, region, and encryption context.

​
Remediation

# Inline IAM policy without kms:* full access
resource "aws_iam_user_policy" "<example_resource_name>" {
  name = "<example_resource_name>-policy"
  user = "<example_resource_name>"

  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = [
        "kms:Encrypt" # CRITICAL: replace 'kms:*' with specific action(s) to remove full access
      ]
      Resource = "*"
    }]
  })
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_inline_policy_no_full_access_to_kms. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks