IAM customer managed policies should not allow decryption actions on all KMS keys

How to fix it

• Can break clients: The new default version applies at once, and its principals can no longer decrypt with any key left out, so take the keys in use from CloudTrail's Decrypt events first.

In the console

• Can't be undone: If the policy already has five versions, saving deletes its oldest non-default version, so copy that version first if it may be needed again.

IAM → Policies → the policy → Permissions → Edit

Resource

The ARN of each key needed, never "*", in every Allow of kms:Decrypt or kms:ReEncryptFrom

Action

kms:Decrypt and kms:ReEncryptFrom only where needed; a wildcard such as kms:* or kms:De* grants them too

Set this new version as the default

Left selected (it is by default); only the default version is read

With the AWS CLI

• Overwrites existing settings: The new version replaces the whole document, so policy.json must keep every other statement, and a policy at five versions needs one removed with delete-policy-version first.

aws iam create-policy-version --policy-arn <policy-arn> --policy-document file://policy.json --set-as-default

With Terraform

resource "aws_iam_policy" "this" {
  name = var.policy_name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["kms:Decrypt"]
      Resource = var.kms_key_arns
    }]
  })
}