6

I am using the Key Management service (KMS) in AWS and am currently setting up key policies.

I created two roles KmsUser and KmsAdmin and attached the following key policy to my CMK:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "KMS KeyAdmin access",
      "Effect": "Allow",
      "Principal": {"AWS": [
          "arn:aws:iam::1234567890:role/KmsAdmin",
      "arn:aws:iam::1234567890:user/myadmin"
      ]},
      "Action": [
        "kms:Create*",
        "kms:Describe*",
        "kms:Enable*",
        "kms:List*",
        "kms:Put*",
        "kms:Update*",
        "kms:Revoke*",
        "kms:Disable*",
        "kms:Get*",
        "kms:Delete*",
        "kms:TagResource",
        "kms:UntagResource",
        "kms:ScheduleKeyDeletion",
        "kms:CancelKeyDeletion"
      ],
    "Resource": "*"
    },
    {
      "Sid": "KMS KeyUser access",
      "Effect": "Allow",
      "Principal": {"AWS": [
          "arn:aws:iam::1234567890:role/KmsUser"
      ]},
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:DescribeKey"
      ],
      "Resource": "*"
    }
  ]
}

The problem is that now if I try to use my key as the myadmin user (which has the AdministratorAccess policy attached) I get an error in the CLI:

$ aws kms encrypt --key-id "alias/test-key" --plaintext fileb:///tmp/plaintext.dat

An error occurred (AccessDeniedException) when calling the Encrypt operation: User: arn:aws:iam::1234567890:user/myadmin is not authorized to perform: kms:Encrypt on resource: arn:aws:kms:eu-north-1:1234567890:key/99999999-9999-9999-9999-99999999999

What is especially strange, is that the IAM policy simulator tells me that everything should work as expected:

enter image description here

If I manually add the myadmin user as a pricipal to the Key User policy, everything works fine.

1
  • Actually above policy is for duty segregation. A key administrator is not supposed to be able to encrypt or decrypt data with the key. So admin can manage keys, but cannot access data. Key user can encrypt or decrypt data, but cannot manage keys. So the correct answer was to use KmsUser role to decrypt/encrypt. Commented May 11, 2020 at 21:28

2 Answers 2

7

You need to add a statement like this to your key policy:

        {
            "Sid": "Enable IAM User Permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::1234567890:root"
            },
            "Action": "kms:*",
            "Resource": "*"
        }

This allows the account to have access to the key, which is required to enable IAM access to it.

3
  • That worked, thank you. Do you know why KMS requires explicit admin permissions in contrast to the other AWS services?
    – mat
    Commented Mar 5, 2020 at 9:06
  • So is this a bug in the policy simulator then? Or am I missing something?
    – mat
    Commented Mar 5, 2020 at 9:08
  • It's not a bug, the simulator is just looking at the data you gave it. It doesn't know what the key policies are. It doesn't even know/care if the resources are real. Using key policies in KMS gives a pretty good rundown of how the key policies work. Commented Mar 5, 2020 at 14:29
2

If you're creating the KMS construct using AWS CDK then make sure to set the trustAccountIdentities to true. Example in TypeScript

const passwordEncryptionKey = new kms.Key(this, 'MyKey', {
  enabled: true,
  trustAccountIdentities: true,
});

Docs are here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.