Deletealias

​

Event Information

• The DeleteAlias event in AWS Key Management Service (KMS) refers to the action of deleting an alias that is associated with a customer master key (CMK).
• When this event occurs, it means that the alias, which provides a human-readable name for the CMK, has been removed from the KMS system.
• This event can be useful for auditing and tracking purposes, as it indicates that the alias is no longer available and any references to it should be updated or removed.

​

Examples

• Unauthorized deletion of a KMS alias: If security is impacted with DeleteAlias in AWS KMS, an example could be an unauthorized user gaining access to the AWS account and deleting a KMS alias. This could result in the loss of access to encrypted data and compromise the security of sensitive information.
• Accidental deletion of a critical KMS alias: Another example could be a scenario where a user with sufficient privileges accidentally deletes a critical KMS alias. This could lead to the inability to decrypt encrypted data, causing disruption to business operations and potentially impacting compliance requirements.
• Malicious deletion of a KMS alias: A third example could involve a malicious insider intentionally deleting a KMS alias. This could be part of an attack aimed at denying access to encrypted data or disrupting the organization’s operations. It could also be an attempt to cover up unauthorized access or data breaches.

​

Remediation

​

Using Console

1. Enable AWS CloudTrail:
   • Go to the AWS Management Console and navigate to the CloudTrail service.
   • Click on “Trails” in the left-hand menu and then click on “Create trail”.
   • Provide a name for the trail, select the desired S3 bucket to store the logs, and enable log file encryption using AWS Key Management Service (KMS).
   • Configure the trail settings according to your requirements and click on “Create trail”.
2. Enable AWS Config:
   • Go to the AWS Management Console and navigate to the AWS Config service.
   • Click on “Get started” if you haven’t enabled AWS Config before.
   • Select the desired AWS resources to be recorded and click on “Next”.
   • Choose the S3 bucket to store the configuration history and enable encryption using AWS KMS.
   • Configure the delivery frequency and click on “Next”.
   • Review the settings and click on “Confirm”.
3. Enable AWS GuardDuty:
   • Go to the AWS Management Console and navigate to the GuardDuty service.
   • Click on “Get started” if you haven’t enabled GuardDuty before.
   • Choose the AWS regions to enable GuardDuty and click on “Next”.
   • Review the settings and click on “Enable GuardDuty”.

​

Using CLI

1. Rotate KMS keys:
   • Identify the KMS key(s) that need to be rotated.
   • Generate a new key using the create-key command: aws kms create-key.
   • Update the necessary resources to use the new key.
   • Schedule the deletion of the old key using the schedule-key-deletion command: aws kms schedule-key-deletion --key-id <old-key-id> --pending-window-in-days <number-of-days>.
   • Monitor the key rotation process and ensure that all resources are successfully using the new key.
2. Enable KMS key rotation:
   • Check if key rotation is already enabled for the KMS key: aws kms get-key-rotation-status --key-id <key-id>.
   • If key rotation is not enabled, enable it using the enable-key-rotation command: aws kms enable-key-rotation --key-id <key-id>.
3. Monitor KMS key usage:
   • Enable CloudTrail logging for KMS API calls to monitor key usage: aws cloudtrail create-trail --name <trail-name> --s3-bucket-name <bucket-name> --is-multi-region-trail --include-global-service-events --enable-log-file-validation.
   • Analyze the CloudTrail logs to identify any suspicious or unauthorized KMS key usage.
   • Set up CloudWatch alarms to notify you of any unusual KMS key activity.

​

Using Python

1. Enable AWS CloudTrail for KMS:
   • Use the boto3 library to create a new CloudTrail trail for KMS.
   • Set the appropriate parameters such as the S3 bucket to store the logs and the KMS key to encrypt the logs.
   • Enable logging for KMS API events by specifying the appropriate event selectors.

import boto3

def enable_cloudtrail_kms():
    client = boto3.client('cloudtrail')
    
    response = client.create_trail(
        Name='kms-trail',
        S3BucketName='your-s3-bucket',
        KmsKeyId='your-kms-key-id',
        IsMultiRegionTrail=True
    )
    
    response = client.update_trail(
        Name='kms-trail',
        EventSelectors=[
            {
                'ReadWriteType': 'All',
                'IncludeManagementEvents': True,
                'DataResources': [
                    {
                        'Type': 'AWS::KMS::Key',
                        'Values': ['*']
                    }
                ]
            }
        ]
    )

2. Enable AWS Config for KMS:
   • Use the boto3 library to create a new AWS Config rule for KMS.
   • Specify the rule parameters such as the required KMS key tags and the desired compliance level.

import boto3

def enable_aws_config_kms():
    client = boto3.client('config')
    
    response = client.put_config_rule(
        ConfigRule={
            'ConfigRuleName': 'kms-key-tags',
            'Description': 'Enforce required tags on KMS keys',
            'Scope': {
                'ComplianceResourceTypes': [
                    'AWS::KMS::Key'
                ]
            },
            'Source': {
                'Owner': 'AWS',
                'SourceIdentifier': 'KMS_KEY_TAGS'
            },
            'InputParameters': '{"requiredTags": ["tag1", "tag2"]}',
            'MaximumExecutionFrequency': 'TwentyFour_Hours'
        }
    )

3. Enable AWS Security Hub for KMS:
   • Use the boto3 library to enable AWS Security Hub for KMS.
   • Specify the appropriate product ARN for KMS.

import boto3

def enable_security_hub_kms():
    client = boto3.client('securityhub')
    
    response = client.batch_enable_standards(
        StandardsSubscriptionRequests=[
            {
                'StandardsArn': 'arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0',
                'ProductArn': 'arn:aws:securityhub:us-west-2:123456789012:product/aws/securityhub'
            }
        ]
    )