Check number 7.36 (Exposed publicly available KMS) is checking only "AWS": "*" and raising red flag

[ankitloud]

To check exposed public KMS key someone need to have below scenario:-

If the "Principal" element value is set to { "AWS": "*" } and the policy statement is not using any Condition clauses to filter the access, the selected AWS KMS master key is publicly accessible.

But prowler is just checking Principle is set to { "AWS": "*" } and then raise a red flag while condition clause is also set like below
"Condition": {
"StringEquals": {
"kms:CallerAccount": ""
},

we should fix it to avoid false positive.

[toniblyx]

Thanks @ankitloud, I agree, that is a check to improve for sure. Can you suggest a better query to make it?

[ankitloud]

I have seen below example for exposed KMS testing at https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/KMS/key-exposed.html#:~:text=02%20Navigate%20to%20KMS%20dashboard,for%20the%20selected%20KMS%20key.
"Principal": {"AWS": "*"}, & "Condition": {"StringEquals": {"kms:CallerAccount": "aacountID"} for a single account.

[lazize]

I am not sure if someone already addressed this issue. But on current version (2.7) it checks for the following condition:

Effect=="Allow" and
(
    ((.Principal|type == "object") and .Principal.AWS == "*") or
    ((.Principal|type == "string") and .Principal == "*")
) and
Condition == null

So it is checking for Condition clause also. Not only Principal.

[jfagoagas]

Hi @ankitloud, could you check it again against this PR #1036?

Currently I've also realised that this check is not auditing KMS keys without an alias, this PR solves it.

Like @lazize said, I think this issue is solved.

[ankitloud]

Hi @jfagoagas @lazize , Yes this is issue is fixed in 2.7 version. I have checked and tested my account. Since my keys are not exposed outside so not getting any failure alert now. Thanks for everyone's corporation.

[jfagoagas]

Thank you @ankitloud !