AWS iot-device-defender high security documentation change
Summary
Added section 'Configure permissions for customer managed keys (optional)' explaining KMS Decrypt permissions requirement for audit roles using CMK
Security assessment
The change addresses a security configuration gap where audit operations would fail without proper KMS:Decrypt permissions when using customer-managed keys. Explicitly states that missing permissions cause audit failures, which impacts security monitoring capabilities.
Diff
diff --git a/iot-device-defender/latest/devguide/audit-tutorial.md b/iot-device-defender/latest/devguide/audit-tutorial.md index b374ddd92..b1ff908fe 100644 --- a//iot-device-defender/latest/devguide/audit-tutorial.md +++ b//iot-device-defender/latest/devguide/audit-tutorial.md @@ -5 +5 @@ -PrerequisitesEnable audit checksView audit resultsCreating audit mitigation actionsApply mitigation actions to your audit findingsCreating an AWS IoT Device Defender Audit IAM role (optional)Enable SNS notifications (optional)Enable logging (optional) +PrerequisitesEnable audit checksView audit resultsCreating audit mitigation actionsApply mitigation actions to your audit findingsCreating an AWS IoT Device Defender Audit IAM role (optional)Enable SNS notifications (optional)Configure permissions for customer managed keys (optional)Enable logging (optional) @@ -26,0 +27,2 @@ This tutorial provides instructions on how to configure a recurring audit, setti + * Configure permissions for customer managed keys (optional) + @@ -183,0 +186,44 @@ In the following procedure, you enable Amazon SNS (SNS) notifications to alert y +## Configure permissions for customer managed keys (optional) + +###### Note + +This configuration is only required if you have opted in to customer managed keys for AWS IoT Core. For more information about AWS IoT Core encryption at rest, see [Data encryption at rest in AWS IoT Core](https://docs.aws.amazon.com/iot/latest/developerguide/encryption-at-rest.html). + +If you have enabled customer managed keys (CMK) for AWS IoT Core encryption at rest, the IAM role used by AWS IoT Device Defender Audit requires additional permissions to decrypt data. Without these permissions, audit operations will fail. + +The [`AWSIoTDeviceDefenderAudit`](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSIoTDeviceDefenderAudit.html) managed policy does not include `kms:Decrypt` permissions by design, following the principle of least privilege. You must manually add these permissions to your audit role when using customer managed keys. + +###### To add KMS permissions to your AWS IoT Device Defender Audit IAM role + + 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). + + 2. In the navigation pane, choose **Roles** , and then search for the role you created in Creating an AWS IoT Device Defender Audit IAM role (optional) or the role you specified when configuring audit settings. + + 3. Choose the role name to open its details page. + + 4. In the **Permissions** tab, choose **Add permissions** , and then choose **Create inline policy**. + + 5. Choose the **JSON** tab and enter the following policy. Replace `REGION`, `ACCOUNT_ID`, and `KEY_ID` with your AWS KMS key details: + + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "kms:Decrypt" + ], + "Resource": "arn:aws:kms:REGION:ACCOUNT_ID:key/KEY_ID" + } + ] + } + + 6. Choose **Next**. + + 7. For **Policy name** , enter a descriptive name such as `DeviceDefenderAuditKMSDecrypt`. + + 8. Choose **Create policy**. + + + +