Critical
KMS
Regional
KMS keys should not be publicly accessible
FSBP
Description
Flags KMS keys that are publicly accessible.
Remediation
To remediate publicly accessible KMS keys, you need to update the key policy to remove public access and implement least privilege access.
Steps
- Navigate to the AWS KMS console
- Select the KMS key that is publicly accessible
- Go to the 'Key policy' tab
- Edit the key policy to remove public access
- Remove any statements with Principal '*' or 'arn:aws:iam::*:root'
- Replace with specific IAM users, roles, or accounts
- Implement least privilege access principles
- Save the updated key policy
- Verify the key is no longer publicly accessible
Compliance
FSBP