IAM policy for tag based access control of KMS keys

0

Dear AWS Community,

I try to come up with an IAM policy to restrict access to customer-managed KMS keys. I'm using an IAM role to deploy infrastructure with Terraform. I want to ensure, that the IAM role is able to create, modify, and delete customer-managed KMS keys. But I want to restrict modify and delete to KMS keys created by the role itself.

My idea was to use tags to restrict access to the kms:ScheduleKeyDeletion and kms:PutKeyPolicy actions with the following IAM policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kms:CreateKey",
        "kms:TagResource"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/Name": "demo"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": "Name"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:ScheduleKeyDeletion",
        "kms:PutKeyPolicy"
      ],
      "Resource": "arn:aws:kms:*:486555357186:key/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/Name": "demo"
        }
      }
    }
  ]
}

However it turns out, that there is no way to restrict access to the kms:TagResource action in a way, that tags can only be added while creating a tag. Instead, the IAM role with this policy is allowed to add the Name tag with value demo to all KMS keys in the account, which bypasses the restriction I'm trying to implement.

Am I missing something, or is there no way to properly implement tag based access control for KMS?

Thanks, Andreas

1 Antwort
0

Do your other non-Terraform KMS keys have any tags that are common/enforced across all keys? If they do you could add a deny policy as described in the KMS Tag Authorization developer guide.

An explicit deny will take precedence over an allow.

AWS
beantwortet vor 9 Monaten

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen