AWS Managed KMS Keys and their Key Policies: Security Implications and Coverage for AWS Services

July 2, 2024
Jason Kao

This is the accompanying blog post to our GitHub release: AWS Managed KMS Key Tracker.  If you have feedback or questions, direct them to [email protected], we'd love to hear from you.

While researching AWS KMS Keys and their security and access implications, we found it difficult to correlate all services that support AWS Managed KMS Keys. Visibility of usage of AWS Managed KMS Keys and their corresponding key policies can be low and may have security and application implications. AWS Managed KMS Keys are keys managed by AWS but exist within your own AWS Account with corresponding key policies. These sometimes are the default key applied to resources.

To provide more visibility, we built a tool that scans and iterates through each AWS service and checks to see if there's an AWS Managed Key and uploads a listing and the corresponding key policies to GitHub.  This tool will periodically scan and update the AWS Managed Key listing and the corresponding key policies.

In this post, we'll cover:

Quick Statistics of AWS Managed KMS Keys (as of July 2024)

GitHub Repository: https://github.com/FogSecurity/aws-managed-kms-keys

Repository Contents:

Impact:

Interesting behavior and lack of visibility of AWS managed KMS keys

When to use and when not to use AWS managed KMS keys

Table from AWS KMS Documentation for types of KMS Keys

Reasons to use AWS Managed KMS Keys:

Reasons not to use AWS Managed KMS Keys:

AWS Managed Key Reporting and Tooling Release

To provide more visibility, we built a tool that scans and iterates through each AWS service and checks to see if there's an AWS Managed Key and uploads a listing and the corresponding key policies to GitHub.  This tool will periodically scan and update the AWS Managed Key listing and the corresponding key policies.

GitHub Repository: https://github.com/FogSecurity/aws-managed-kms-keys

Reference aws/rds AWS Managed Key Policy

If you want to chat cloud data security, email us at [email protected], we'd love to hear from you.

Subscribe to stay up to date on cloud data security and our work.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.