0

I'm having a little trouble getting my head around some IAM policy syntax to do with MWAA and KMS, and was wondering if anyone may be able to help me understand please.

From this doc:

https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-create-role.html

Towards the end, there is a bit of policy that allows the role for MWAA to be able to use a built in AWS KMS key.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "airflow:PublishMetrics",
            "Resource": "arn:aws:airflow:{your-region}:{your-account-id}:environment/{your-environment-name}"
        },
        { 
            "Effect": "Deny",
            "Action": "s3:ListAllMyBuckets",
            "Resource": [
                "arn:aws:s3:::{your-s3-bucket-name}",
                "arn:aws:s3:::{your-s3-bucket-name}/*"
            ]
        },
        { 
            "Effect": "Allow",
            "Action": [ 
                "s3:GetObject*",
                "s3:GetBucket*",
                "s3:List*"
            ],
            "Resource": [
                "arn:aws:s3:::{your-s3-bucket-name}",
                "arn:aws:s3:::{your-s3-bucket-name}/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:CreateLogGroup",
                "logs:PutLogEvents",
                "logs:GetLogEvents",
                "logs:GetLogRecord",
                "logs:GetLogGroupFields",
                "logs:GetQueryResults"
            ],
            "Resource": [
                "arn:aws:logs:{your-region}:{your-account-id}:log-group:airflow-{your-environment-name}-*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogGroups"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetAccountPublicAccessBlock"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "cloudwatch:PutMetricData",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "sqs:ChangeMessageVisibility",
                "sqs:DeleteMessage",
                "sqs:GetQueueAttributes",
                "sqs:GetQueueUrl",
                "sqs:ReceiveMessage",
                "sqs:SendMessage"
            ],
            "Resource": "arn:aws:sqs:{your-region}:*:airflow-celery-*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:DescribeKey",
                "kms:GenerateDataKey*",
                "kms:Encrypt"
            ],
            "NotResource": "arn:aws:kms:*:{your-account-id}:key/*",
            "Condition": {
                "StringLike": {
                    "kms:ViaService": [
                        "sqs.{your-region}.amazonaws.com"
                    ]
                }
            }
        }
    ]
}

I am not understanding this last block.

  • It's an 'Allow' action.
  • It contains KMS actions.

But I don't understand why the key is "NotResource" ?

The key listed is the one we want to allow, so why does this seem backwards?

Anyone able to word the logic to help me understand this?

Henry Ecker
  • 34,399
  • 18
  • 41
  • 57
Scott
  • 45
  • 5

1 Answers1

1

The sample policy is for "AWS owned key". Now, AWS owned keys a collection of KMS keys that an AWS service owns and those are not in your AWS account. So, the policy statement "NotResource": "arn:aws:kms:*:{your-account-id}:key/*" implies Allow the Action's specified in the policy for any KMS resources which are NOT in your AWS account e.g. AWS owned keys (provided the key owner grants you access) and when it's in use via SQS service.

sudo
  • 2,237
  • 1
  • 9
  • 14