By Implementation

Service Control PoliciesConfig RulesAuto Remediation RulesConformance PacksAmazon GuardDutyAmazon InspectorAWS Security HubAWS Network FirewallAmazon MacieS3 Bucket PoliciesCloudWatch Alarms and Event RulesAWS WAFAWS Secrets ManagerAWS Systems ManagerSecurity Groups & NACLsAWS KMSIAM Policies

By Service Protected

Configuration Packages

Strategy Guides

Other

AWS KMS

A collection of AWS Security controls for AWS KMS. Controls include configuration to create KMS keys, IAM policies, CloudWatch events and alarms for monitoring as well as Config rules. Configuration templates are available in AWS CloudFormation, AWS CLI and Terraform

KMS

Configuration to create an AWS KMS Customer Master Key (CMK).

CloudFormationTerraformAWS CLI

Configuration to create an AWS KMS Customer Master Key (CMK) with automatic key rotation enabled.

CloudFormationTerraformAWS CLI
Monitoring & Compliance Packages

A configuration package to monitor KMS related API activity as well as configuration compliance rules to ensure the security of AWS KMS configuration. The package includes Config Rules, CloudWatch Alarms, and CloudWatch Event Rules, and uses SNS to deliver email notifications. The package also includes configuration to enable the required AWS logging services: AWS CloudTrail, Config, and CloudWatch log groups

CloudFormationTerraform
Config Rule

A config rule that checks that key rotation is enabled for each customer master key (CMK). The rule is COMPLIANT, if the key rotation is enabled for specific key object. The rule is not applicable to CMKs that have imported key material.

CloudFormationTerraformAWS CLI

A config rule that checks that Customer Managed keys are not scheduled for deletion

CloudFormationTerraformAWS CLI
CloudWatch Alarms

Alarm if customer created CMKs get disabled or scheduled for deletion.

CloudFormationTerraformAWS CLI

A CloudWatch Alarm that triggers on changes to customer created CMKs: Key creation, deletion, or enabling/disabling operations, as well as updates to CMK Key policies.

CloudFormationTerraformAWS CLI
CloudWatch Events

A CloudWatch Event Rule that detects KMS Customer Master Key (CMK) changes and publishes change events to an SNS topic for notification.

CloudFormationTerraformAWS CLI

A CloudWatch Event Rule that triggers on AWS KMS Customer Master Key (CMK) deletion events.

CloudFormationTerraformAWS CLI

A CloudWatch Event Rule that triggers on AWS KMS Customer Master Key (CMK) rotation events.

CloudFormationTerraformAWS CLI

A CloudWatch Event Rule that triggers on AWS KMS Customer Master Key (CMK) imported material expiration events.

CloudFormationTerraformAWS CLI
IAM Policy

An IAM policy that allows IAM users read-only access to the AWS KMS console. That is, users can use the console to view all CMKs, but they cannot make changes to any CMKs or create new ones.

CloudFormationTerraformAWS CLI

An IAM policy that allows IAM users to successfully request that AWS KMS encrypt and decrypt data with any CMK in the specified AWS account and region.

CloudFormationTerraformAWS CLI

An IAM policy that allows IAM users to successfully request that AWS KMS encrypt and decrypt data with a specific CMK.

CloudFormationTerraformAWS CLI

An IAM policy that prevents a user from disabling or deleting any CMKs, even when another IAM policy or a key policy allows these permissions.

CloudFormationTerraformAWS CLI
Service Control Policy

This SCP prevents users or roles in any affected account from deleting KMS keys, either directly as a command or through the console.

CloudFormationTerraformAWS CLI
KMS
Monitoring & Compliance Packages
Config Rule
CloudWatch Alarms
CloudWatch Events
IAM Policy
Service Control Policy