Inline IAM policy does not allow kms:* privileges
iam_inline_policy_no_full_access_to_kms
IAM inline policies are analyzed to identify statements that grant unrestricted AWS KMS access via the wildcard action kms:*.
Risk
Granting kms:* enables decryption of protected data, modification of key policies and grants, and disabling or deleting keys.
Impacts:
- Confidentiality via unauthorized decryption
- Integrity through key/grant tampering
- Availability if keys are disabled or deleted, breaking encrypted workloads
prowler aws --checks iam_inline_policy_no_full_access_to_kms
Recommendation
Replace kms:* with least-privilege, action-scoped permissions limited to required operations and specific key ARNs. Enforce separation of duties for key admins vs users. Prefer managed policies over inline and apply guardrails (permissions boundaries/SCPs). Add conditions to constrain service, region, and encryption context.
Remediation
- In the AWS Console, open IAM and go to Users, Roles, or Groups (where the inline policy is attached)
- Select the entity, go to the Permissions tab, and open the inline policy that allows KMS
- Click Edit policy and switch to the JSON editor
- Replace any "Action": "kms:*" with only the specific KMS action(s) required (e.g., "kms:Encrypt")
- Save changes
Source Code
Resource Type
AwsIamPolicy