AWS re:Post을(를) 사용하면 다음에 동의하게 됩니다. AWS re:Post 이용 약관

Controlling access to KMS keys using aliases fails

0

I'm trying to control access to KMS keys based on their alias with a policy, following the guidance here.

I want the policy to:

  • Allow general access to kms operations for unrestricted keys
  • Deny all access to keys that are restricted (have an alias matching restricted)

Here is my attempt:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAll",
      "Effect": "Allow",
      "Action": ["kms:*"],
      "Resource": "*",
    },
    {
      "Sid": "DenyKMSForProduction",
      "Effect": "Deny",
      "Action": ["kms:*"],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringLike": {
          "kms:RequestAlias": [
            "alias/*restricted*",
            "alias/*RESTRICTED*"
          ],
          "kms:ResourceAliases": [
            "alias/*restricted*",
            "alias/*RESTRICTED*"
          ]
        }
      }
    }
  ]
}

However, when I test this policy with the IAM policy simulator, it fails.

  • Access to kms keys that have an alias with restricted are allowed, even if I pass in a request alias or resource alias in this simulator
  • In my understanding of evaluation logic, any deny statement will be evaluated first, so operations to the key with the restricted alias should be denied
  • And even if I review the Allow * sid, it still only fails with an implicit deny, not an explicit deny

Is this a limitation with the simulator, or an issue with my policy?

1개 답변
1
수락된 답변

The following example IAM policy statement allows the principal to enable and disable KMS keys but only when all aliases of the KMS keys include "Test." This policy statement uses two conditions. The condition with the ForAllValues set operator requires that all aliases associated with the KMS key include "Test". The condition with the ForAnyValue set operator requires that the KMS key have at least one alias with "Test." Without the ForAnyValue condition, this policy statement would have allowed the principal to use KMS keys that had no aliases.

{
  "Sid": "AliasBasedIAMPolicy",
  "Effect": "Allow",
  "Action": [
    "kms:EnableKey",
    "kms:DisableKey"
  ],
  "Resource": "arn:aws:kms:*:111122223333:key/*",
  "Condition": {
    "ForAllValues:StringLike": {
      "kms:ResourceAliases": [
        "alias/*Test*"
      ]
    },
    "ForAnyValue:StringLike": {
      "kms:ResourceAliases": [
        "alias/*Test*"
      ]
    }
  }
}
AWS
답변함 2년 전
profile picture
전문가
검토됨 4달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠