All checks
Medium
IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys
Detects IAM customer managed policies that allow decryption on all KMS keys without restriction, which can lead to unauthorized access to encrypted data.
- service
- KMS
- severity
- Medium
- scope
- evaluated once per account
How to fix it
To remediate policies that allow decryption actions on all KMS keys, you need to update the policy to restrict the kms:Decrypt action to specific resources or remove it entirely.
- Open the IAM console at https://console.aws.amazon.com/iam/.
- In the navigation pane, click Policies and then select the customer managed policy to modify.
- Click the policy version and then click Edit policy.
- Modify the policy to remove the kms:Decrypt action or restrict it to specific resources.
- Review the changes, then click Review policy and Save changes.
See which of your accounts this check is failing on.
Book a demo