understanding kms policy?

Question

I have a IAM group called group-dev and couple of users attached to this group, I have custom IAM policy(below). Does this IAM policy alone be sufficient for users in that group to encrypt and list kms keys?

Basically My goal is to create IAM group with policy attached to couple of users, and when new users are added i don't want to go about do double work like adding them to group and then adding them to kms key policy. So would it work with the below policies ?

IAM group inline policy

{
      "Action": [
        "kms:List*",
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:Describe*",
        "kms:Get*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },

kms policy 


{
    "Id": "key-consolepolicy",
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::xxxxxxxxxx:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        }

Below are snippets from aws doc: https://docs.amazonaws.cn/en_us/kms/latest/developerguide/kms-dg.pdf#page=95&zoom=100,96,105

Allowing multiple IAM users to access a CMK
IAM groups are not valid principals in a key policy. To allow multiple IAM users to access a CMK, do one of
the following:
• Add each IAM user to the key policy. This approach requires that you update the key policy each time
the list of authorized users changes.
• Ensure that the key policy includes the statement that enables IAM policies to allow access to the
CMK (p. 72). Then create an IAM policy that allows access to the CMK, and then attach that policy to
an IAM group that contains the authorized IAM users. Using this approach, you don't need to change
any policies when the list of authorized users changes. Instead, you only need to add or remove those
users from the appropriate IAM group.

Looks like there are contradicting statements, or is it something i misunderstood?

. Enables IAM policies to allow access to the CMK.
IAM policies by themselves are not sufficient to allow access to a CMK. However, you can use them
in combination with a CMK's key policy if the key policy enables it. Giving the AWS account full
access to the CMK does this; it enables you to use IAM policies to give IAM users and roles in the
account access to the CMK. It does not by itself give any IAM users or roles access to the CMK, but it
enables you to use IAM policies to do so. For more information, see Managing access to AWS KMS
CMKs (p. 69).

score 6 · Accepted Answer · answered Jul 30 '20 at 17:09

6

First to compare how these work together each CMK (Customer Managed Key) is created with a key policy that restricts which principal (the caller of the action i.e. IAM Role/IAM User/Service) can access it (and the permissions that the principal will have). It does not matter whichever IAM permissions you grant, if your key policy does not allow the permission no IAM user (including the root user) can perform the action.

The IAM policy attached to the users will grant the maximum permissions that the user can perform. When the action is evaluated the key policy permissions are evaluated as well, if the permission is allowed in both policies the principal will be allowed to perform the action.

So in summary, for KMS both the key policy and the IAM policy permissions must allow access. The permissions you have would allow the users to have the majority of access to the KMS key.

answered Jul 30 '20 at 17:09

Chris Williams

32,215
4
30
68

So I should have users attached to the group as well as to the kms policy right? – user6826691 Jul 30 '20 at 17:13
3

With the key policy you have at the moment anyone within that account has all of the permissions, this is because of `arn:aws:iam::xxxxxxxxxx:root`. If you wanted to restrict to these users the Principal would just need to contain the Arns of the users individually instead :) – Chris Williams Jul 30 '20 at 17:16
1

@ChrisWilliams according to the documentation 'root' means user root , not everyone in the account https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html – Sergei Dec 20 '21 at 11:00
From practice, I can say that @ChrisWilliams is correct. Having that "root" statement in there seems to allow everything and hands over policy management to IAM. I think that's also why they put "Enable IAM User Permissions" as Sid. – Moritz Mar 10 '22 at 15:03
@sergei you mentioned it correctly. This is the default key policy which allows only root user and adminstrators to manage key policy but not access the KMS key (until their IAM user policy has KMS access on it). – cherish sham Aug 02 '23 at 05:02

understanding kms policy?

1 Answers1

Linked