Description

Detects AWS KMS key configurations where the key policy contains overly permissive principal definitions (like wildcards) that could allow unauthorized access to the master keys. This represents a security risk as it may enable unintended users to perform cryptographic operations with sensitive keys.

Detection Strategy

• Scans Terraform configuration files containing AWS KMS key resource definitions

• Identifies KMS key resources by looking for 'aws_kms_key' resource blocks

• Examines the key policy statements to find principal fields

• Reports a vulnerability if the policy contains wildcard principals (like '*') that grant broad access

• Each KMS key resource with overly permissive principals will trigger a separate vulnerability alert

Vulnerable code example

resource "aws_kms_key" "example_key" {
  description             = "Example KMS key"
  deletion_window_in_days = 7

  policy = <<-EOF            # Vulnerable: Policy allows access to all AWS principals ("AWS": "*")
  {
    "Version": "2012-10-17",
    "Statement": [...

✅ Secure code example

resource "aws_kms_key" "example_key" {
  description             = "Example KMS key"
  deletion_window_in_days = 30                # Increased deletion window for safety
  enable_key_rotation     = true              # Enable automatic key rotation
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [...