Custom IAM policy does not allow 'kms:*' privileges

Check ID: iam_policy_no_full_access_to_kms
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: AwsIamPolicy

What this check verifies

Customer-managed IAM policies are examined for statements that grant AWS KMS full access using kms:*. The focus is on policies allowing service-wide actions rather than narrowly scoped, key-specific permissions.

Risk

Allowing kms:* lets principals decrypt data, change key policies, and disable or delete keys. Impact: Confidentiality-unauthorized decryption; Integrity-manipulation of cryptographic controls; Availability-data unreadable if keys are disabled/deleted. It can also enable privilege escalation.

Recommendation

Adopt least privilege and separation of duties:

Replace kms:* with only needed actions scoped to specific key ARNs
Apply policy conditions (e.g., kms:ViaService) and guardrails (permissions boundaries/SCPs)
Monitor KMS usage and refine access based on activity

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam create-policy-version --policy-arn <POLICY_ARN> --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["kms:Encrypt"],"Resource":"arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KEY_ID>"}]}' --set-as-default

# Customer managed policy without kms:* full access
resource "aws_iam_policy" "<example_resource_name>" {
  name   = "<example_resource_name>"
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["kms:Encrypt"]  # FIX: remove 'kms:*'; allow only specific KMS action
      Resource = "arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<example_resource_id>"  # FIX: scope to a specific key
    }]
  })
}

# CloudFormation: customer managed policy without kms:* full access
Resources:
  <example_resource_name>:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - kms:Encrypt  # FIX: remove 'kms:*'; allow only specific KMS action
            Resource: arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<example_resource_id>  # FIX: scope to a specific key

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_policy_no_full_access_to_kms. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Customer managed IAM policy blocks cloudtrail:* privileges Custom IAM policy blocks marketplace:Subscribe on all

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires