Enforce KMS Key Policies for Central Landing Zone Accounts
Specification & Description
Enforce hardened KMS key policies in the Log Archive and Audit accounts to enforce separation of duties, restrict key usage to authorized AWS services via condition keys, and prevent privilege escalation through key policy overwrites or unrestricted grant creation.
Technical Specifications
Customer Managed Keys (CMKs) in the Log Archive and Audit accounts encrypt the most sensitive data in the landing zone: CloudTrail logs, Config history, Security Hub findings, and AWS Backup recovery points. A weak key policy undermines all other controls; three failure modes are most common:
- Violation of Separation of Duties: Key administrators are granted
kms:Decryptorkms:Encrypt. - Policy Overwrite Risk:
kms:PutKeyPolicyis left unrestricted, allowing admins to grant themselves decryption rights. - Unconstrained Grants:
kms:CreateGrantis not restricted bykms:GrantIsForAWSResource, allowing arbitrary access for third-party principals.
This control defines the minimum key policy structure, mandates annual rotation, and uses kms:ViaService to restrict decryption to authorized service endpoints.
Security Rationale
KMS key policies are the last line of defense for encrypted data. IAM policies cannot grant access to a KMS key that the key policy does not allow - but the inverse is not true. A permissive key policy can grant access regardless of IAM boundaries. In the Log Archive and Audit accounts, where keys protect immutable audit records and security findings, a misconfigured key policy can silently nullify the confidentiality guarantees of every upstream encryption control in the landing zone.
Policy Exceptions (2)
AWS-managed keys (KeyManager: AWS) are excluded from this control. Their key policies are managed by AWS and cannot be modified. Separation of duties and rotation are enforced by AWS automatically.
Asymmetric CMKs used for digital signing (e.g. for artifact verification) are exempt from the automatic rotation requirement - AWS KMS does not support rotation for asymmetric keys. Rotation for these keys must be handled by creating a new key version and updating all consumers manually on a documented schedule.
Operational & Implementation Notes
The root account statement (AllowRootAccountFullControl) is mandatory in every KMS key policy - omitting it produces a key that can only be managed via the key policy itself, and a policy mistake can lock the key permanently. The kms:ViaService condition value format is exactly service.region.amazonaws.com for most services; CloudTrail is a global service and uses cloudtrail.amazonaws.com without a region segment.