AWS IAM: Added KMS:Decrypt permission with wildcard resource in AAM policy
Summary
Policy changes include broadening resource scope to '*' in multiple statements, adding new actions for identity/organization services, and introducing a DependentKMSActions statement allowing kms:Decrypt on any resource.
Security assessment
The evidence shows a wildcard resource added for kms:Decrypt, potentially allowing decryption of any KMS key in the account if compromised, which violates least privilege.
Evidence
+ "Resource": "*"
Diff
diff --git a/IAM/latest/UserGuide/aam-security.md b/IAM/latest/UserGuide/aam-security.md index 9abde15c6..8935cf49e 100644 --- a//IAM/latest/UserGuide/aam-security.md +++ b//IAM/latest/UserGuide/aam-security.md @@ -33 +33 @@ To administer account access manager settings in the AWS organization management - "Sid": "AAMCreateApplicationOnIdentityCenterInstance", + "Sid": "AAMCreateApplication", @@ -36 +36 @@ To administer account access manager settings in the AWS organization management - "Resource": "arn:aws:sso:::instance/ssoins-EXAMPLE1234567890" + "Resource": "*" @@ -42,2 +41,0 @@ To administer account access manager settings in the AWS organization management - "account-access:GetApplication", - "account-access:DeleteApplication", @@ -44,0 +43 @@ To administer account access manager settings in the AWS organization management + "account-access:DeleteApplication", @@ -45,0 +45 @@ To administer account access manager settings in the AWS organization management + "account-access:GetApplication", @@ -64,2 +63,0 @@ To administer account access manager settings in the AWS organization management - "sso:DescribeInstance", - "sso:DescribeRegion", @@ -69,2 +67,4 @@ To administer account access manager settings in the AWS organization management - "sso:PutApplicationAuthenticationMethod", - "sso:PutApplicationGrant", + "sso:DescribeInstance", + "sso:DescribeRegion", + "sso:ListInstances", + "sso:PutApplicationAccessScope", @@ -72 +72,20 @@ To administer account access manager settings in the AWS organization management - "sso:PutApplicationAccessScope" + "sso:PutApplicationAuthenticationMethod", + "sso:PutApplicationGrant" + ], + "Resource": "*" + }, + { + "Sid": "DependentIdentityStoreActions", + "Effect": "Allow", + "Action": [ + "identitystore:DescribeGroup", + "identitystore:DescribeUser", + "identitystore:ListGroupMemberships", + "sso-directory:DescribeGroup", + "sso-directory:DescribeGroups", + "sso-directory:DescribeUser", + "sso-directory:DescribeUsers", + "sso-directory:ListGroupsForUser", + "sso-directory:ListMembersInGroup", + "sso-directory:SearchGroups", + "sso-directory:SearchUsers" @@ -79,0 +99 @@ To administer account access manager settings in the AWS organization management + "organizations:DescribeAccount", @@ -81 +101,6 @@ To administer account access manager settings in the AWS organization management - "organizations:ListAWSServiceAccessForOrganization" + "organizations:ListAccounts", + "organizations:ListAccountsForParent", + "organizations:ListAWSServiceAccessForOrganization", + "organizations:ListDelegatedAdministrators", + "organizations:ListOrganizationalUnitsForParent", + "organizations:ListRoots" @@ -84,0 +110,6 @@ To administer account access manager settings in the AWS organization management + { + "Sid": "DependentKMSActions", + "Effect": "Allow", + "Action": "kms:Decrypt", + "Resource": "*" + }, @@ -89 +120 @@ To administer account access manager settings in the AWS organization management - "Resource": "arn:aws:iam::111122223333:role/aws-service-role/account-access.amazonaws.com/AWSServiceRoleForAccountAccess", + "Resource": "arn:aws:iam::111122223333:role/aws-service-role/account-access.amazonaws.com/AWSServiceRoleForAccountAccessManager", @@ -99 +130 @@ To administer account access manager settings in the AWS organization management -**Optional:** To constrain `account-access:CreateApplication` by tag, use: +**Optional:** To constrain `account-access:CreateApplication` by tag, replace the AAMCreateApplication statement with: @@ -106 +137 @@ To administer account access manager settings in the AWS organization management - "Resource": "arn:aws:sso:::instance/ssoins-EXAMPLE1234567890", + "Resource": "*", @@ -119,16 +149,0 @@ To administer account access manager settings in the AWS organization management -**Optional:** To use a customer managed KMS key, include: - - - { - "Sid": "CustomerManagedKeyForAccountAccessManager", - "Effect": "Allow", - "Action": [ - "kms:DescribeKey", - "kms:Decrypt", - "kms:GenerateDataKeyWithoutPlaintext", - "kms:ReEncryptFrom", - "kms:ReEncryptTo" - ], - "Resource": "arn:aws:kms:*:111122223333:key/EXAMPLE-KEY-ID" - } - @@ -142,2 +157,2 @@ To administer account access manager settings in the AWS organization management - "organizations:RegisterDelegatedAdministrator", - "organizations:DeregisterDelegatedAdministrator" + "organizations:DeregisterDelegatedAdministrator", + "organizations:RegisterDelegatedAdministrator" @@ -164,0 +180 @@ To assign IAM roles to your workforce users and groups from the AWS organization + "account-access:GetApplication", @@ -166,2 +182 @@ To assign IAM roles to your workforce users and groups from the AWS organization - "account-access:ListEntitlements", - "account-access:GetApplication" + "account-access:ListEntitlements" @@ -175,0 +191,39 @@ To assign IAM roles to your workforce users and groups from the AWS organization + }, + { + "Sid": "DependentIdentityCenterActions", + "Effect": "Allow", + "Action": "sso:ListInstances", + "Resource": "*" + }, + { + "Sid": "DependentIdentityStoreActions", + "Effect": "Allow", + "Action": [ + "identitystore:DescribeGroup", + "identitystore:DescribeUser", + "identitystore:ListGroupMemberships", + "sso-directory:DescribeGroup", + "sso-directory:DescribeGroups", + "sso-directory:DescribeUser", + "sso-directory:DescribeUsers", + "sso-directory:ListGroupsForUser", + "sso-directory:ListMembersInGroup", + "sso-directory:SearchGroups", + "sso-directory:SearchUsers" + ], + "Resource": "*" + }, + { + "Sid": "DependentOrganizationsActions", + "Effect": "Allow", + "Action": [ + "organizations:DescribeAccount", + "organizations:DescribeOrganization", + "organizations:ListAccounts", + "organizations:ListAccountsForParent", + "organizations:ListAWSServiceAccessForOrganization", + "organizations:ListDelegatedAdministrators", + "organizations:ListOrganizationalUnitsForParent", + "organizations:ListRoots" + ], + "Resource": "*" @@ -192 +245,0 @@ To administer account access manager settings from a delegated administration ac - "account-access:GetApplication", @@ -194,0 +248 @@ To administer account access manager settings from a delegated administration ac + "account-access:GetApplication", @@ -207,0 +262,44 @@ To administer account access manager settings from a delegated administration ac + }, + { + "Sid": "DependentIdentityCenterActions", + "Effect": "Allow", + "Action": [ + "sso:DescribeApplication", + "sso:DescribeInstance", + "sso:DescribeRegion", + "sso:ListInstances" + ], + "Resource": "*" + }, + { + "Sid": "DependentIdentityStoreActions", + "Effect": "Allow", + "Action": [ + "identitystore:DescribeGroup", + "identitystore:DescribeUser", + "identitystore:ListGroupMemberships", + "sso-directory:DescribeGroup", + "sso-directory:DescribeGroups", + "sso-directory:DescribeUser", + "sso-directory:DescribeUsers", + "sso-directory:ListGroupsForUser", + "sso-directory:ListMembersInGroup", + "sso-directory:SearchGroups", + "sso-directory:SearchUsers" + ], + "Resource": "*" + }, + { + "Sid": "DependentOrganizationsActions", + "Effect": "Allow", + "Action": [ + "organizations:DescribeAccount", + "organizations:DescribeOrganization", + "organizations:ListAccounts", + "organizations:ListAccountsForParent", + "organizations:ListAWSServiceAccessForOrganization", + "organizations:ListDelegatedAdministrators", + "organizations:ListOrganizationalUnitsForParent", + "organizations:ListRoots" + ], + "Resource": "*" @@ -223,0 +322 @@ To assign IAM roles to workforce users and groups from a delegated administratio + "account-access:GetApplication", @@ -225,2 +324 @@ To assign IAM roles to workforce users and groups from a delegated administratio - "account-access:ListEntitlements", - "account-access:GetApplication" + "account-access:ListEntitlements" @@ -234,0 +333,39 @@ To assign IAM roles to workforce users and groups from a delegated administratio + },