Control: KMS key decryption should be restricted in IAM inline policy
Description
Checks whether the inline policies that are embedded in your IAM identities (role, user, or group) allow the AWS KMS decryption actions on all KMS keys. This control uses Zelkova, an automated reasoning engine, to validate and warn you about policies that may grant broad access to your secrets across AWS accounts. This control fails if kms:Decrypt or kms:ReEncryptFrom actions are allowed on all KMS keys in an inline policy.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.kms_key_decryption_restricted_in_iam_inline_policySnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.kms_key_decryption_restricted_in_iam_inline_policy --shareSQL
This control uses a named query:
kms_key_decryption_restricted_in_iam_inline_policy