Blocked KMS Actions In IAM Policies Should Be Set

To prevent blocked KMS actions in IAM policies using AWS CLI, you need to ensure that your IAM policies are correctly configured to allow necessary KMS actions and deny any inappropriate ones. Here are the steps to achieve this:

1. Create a JSON Policy Document:

   • First, create a JSON policy document that specifies the allowed and denied KMS actions. Save this document locally, for example, as kms_policy.json.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "kms:Encrypt",
           "kms:Decrypt",
           "kms:GenerateDataKey"
         ],
         "Resource": "*"
       },
       {
         "Effect": "Deny",
         "Action": [
           "kms:DeleteKey",
           "kms:ScheduleKeyDeletion"
         ],
         "Resource": "*"
       }
     ]
   }
   

2. Create or Update the IAM Policy:

   • Use the AWS CLI to create a new IAM policy or update an existing one with the JSON policy document.

   aws iam create-policy --policy-name MyKMSPolicy --policy-document file://kms_policy.json
   

   If you need to update an existing policy, use:

   aws iam update-policy --policy-arn arn:aws:iam::aws:policy/MyKMSPolicy --policy-document file://kms_policy.json
   

3. Attach the Policy to IAM Users, Groups, or Roles:

   • Attach the newly created or updated policy to the relevant IAM users, groups, or roles.

   aws iam attach-user-policy --user-name MyUser --policy-arn arn:aws:iam::aws:policy/MyKMSPolicy
   

   Similarly, for groups or roles:

   aws iam attach-group-policy --group-name MyGroup --policy-arn arn:aws:iam::aws:policy/MyKMSPolicy
   

   aws iam attach-role-policy --role-name MyRole --policy-arn arn:aws:iam::aws:policy/MyKMSPolicy
   

4. Verify the Policy Attachment:

   • Verify that the policy has been correctly attached to the IAM users, groups, or roles.

   aws iam list-attached-user-policies --user-name MyUser
   

   Similarly, for groups or roles:

   aws iam list-attached-group-policies --group-name MyGroup
   

   aws iam list-attached-role-policies --role-name MyRole
   

By following these steps, you can ensure that your IAM policies are configured to allow necessary KMS actions while blocking potentially harmful ones.

To prevent blocked KMS actions in IAM policies using Python scripts, you can use the AWS SDK for Python (Boto3). Here are the steps to ensure that KMS actions are properly set in IAM policies:

1. Install Boto3: Ensure you have Boto3 installed in your Python environment. You can install it using pip if you haven’t already:

   pip install boto3
   

2. Initialize Boto3 Client: Initialize the Boto3 client for IAM and KMS.

   import boto3
   
   iam_client = boto3.client('iam')
   kms_client = boto3.client('kms')
   

3. Retrieve and Update IAM Policies: Retrieve the IAM policies and check for KMS actions. If they are not set correctly, update the policy.

   def get_iam_policies():
       paginator = iam_client.get_paginator('list_policies')
       for response in paginator.paginate(Scope='Local'):
           for policy in response['Policies']:
               policy_arn = policy['Arn']
               policy_version = iam_client.get_policy_version(
                   PolicyArn=policy_arn,
                   VersionId=policy['DefaultVersionId']
               )
               yield policy_arn, policy_version['PolicyVersion']['Document']
   
   def update_policy(policy_arn, policy_document):
       # Add or modify the KMS actions in the policy document as needed
       # Example: Adding a statement to allow KMS actions
       kms_statement = {
           "Effect": "Allow",
           "Action": [
               "kms:Encrypt",
               "kms:Decrypt",
               "kms:GenerateDataKey"
           ],
           "Resource": "*"
       }
       policy_document['Statement'].append(kms_statement)
       
       # Update the policy with the new document
       iam_client.create_policy_version(
           PolicyArn=policy_arn,
           PolicyDocument=json.dumps(policy_document),
           SetAsDefault=True
       )
   
   for policy_arn, policy_document in get_iam_policies():
       update_policy(policy_arn, policy_document)
   

4. Validate the Changes: Ensure that the changes have been applied correctly by validating the updated policies.

   def validate_policies():
       for policy_arn, policy_document in get_iam_policies():
           for statement in policy_document['Statement']:
               if 'kms:' in statement['Action']:
                   print(f"KMS actions are correctly set in policy: {policy_arn}")
               else:
                   print(f"KMS actions are missing in policy: {policy_arn}")
   
   validate_policies()
   

This script will help you ensure that KMS actions are properly set in IAM policies by retrieving existing policies, updating them if necessary, and validating the changes.