Configuration to create an AWS KMS Customer Master Key (CMK).
CloudFormationTerraformAWS CLI
By Implementation
Service Control PoliciesConfig RulesAuto Remediation RulesConformance PacksAmazon GuardDutyAmazon InspectorAWS Security HubAWS Network FirewallAmazon MacieS3 Bucket PoliciesCloudWatch Alarms and Event RulesAWS WAFAWS Secrets ManagerAWS Systems ManagerSecurity Groups & NACLsAWS KMSIAM Policies
By Service Protected
Configuration Packages
Strategy Guides
Other
By Service Protected
By Implementation
Service Control Policies
Config Rules
Auto Remediation Rules
Conformance Packs
Amazon GuardDuty
Amazon Inspector
AWS Security Hub
AWS Network Firewall
Amazon Macie
S3 Bucket Policies
CloudWatch Alarms and Event Rules
AWS WAF
AWS Secrets Manager
AWS Systems Manager
Security Groups & NACLs
AWS KMS
IAM PoliciesConfiguration Packages
Strategy Guides
Other
AWS KMS
A collection of AWS Security controls for AWS KMS. Controls include configuration to create KMS keys, IAM policies, CloudWatch events and alarms for monitoring as well as Config rules. Configuration templates are available in AWS CloudFormation, AWS CLI and Terraform
KMS
Configuration to create an AWS KMS Customer Master Key (CMK) with automatic key rotation enabled.
CloudFormationTerraformAWS CLI
Monitoring & Compliance Packages
A configuration package to monitor KMS related API activity as well as configuration compliance rules to ensure the security of AWS KMS configuration. The package includes Config Rules, CloudWatch Alarms, and CloudWatch Event Rules, and uses SNS to deliver email notifications. The package also includes configuration to enable the required AWS logging services: AWS CloudTrail, Config, and CloudWatch log groups
CloudFormationTerraform
Config Rule
A config rule that checks that key rotation is enabled for each customer master key (CMK). The rule is COMPLIANT, if the key rotation is enabled for specific key object. The rule is not applicable to CMKs that have imported key material.
CloudFormationTerraformAWS CLI
A config rule that checks that Customer Managed keys are not scheduled for deletion
CloudFormationTerraformAWS CLI
CloudWatch Alarms
Alarm if customer created CMKs get disabled or scheduled for deletion.
CloudFormationTerraformAWS CLI
A CloudWatch Alarm that triggers on changes to customer created CMKs: Key creation, deletion, or enabling/disabling operations, as well as updates to CMK Key policies.
CloudFormationTerraformAWS CLI
CloudWatch Events
A CloudWatch Event Rule that detects KMS Customer Master Key (CMK) changes and publishes change events to an SNS topic for notification.
CloudFormationTerraformAWS CLI
A CloudWatch Event Rule that triggers on AWS KMS Customer Master Key (CMK) deletion events.
CloudFormationTerraformAWS CLI
A CloudWatch Event Rule that triggers on AWS KMS Customer Master Key (CMK) rotation events.
CloudFormationTerraformAWS CLI
A CloudWatch Event Rule that triggers on AWS KMS Customer Master Key (CMK) imported material expiration events.
CloudFormationTerraformAWS CLI
IAM Policy
An IAM policy that allows IAM users read-only access to the AWS KMS console. That is, users can use the console to view all CMKs, but they cannot make changes to any CMKs or create new ones.
CloudFormationTerraformAWS CLI
An IAM policy that allows IAM users to successfully request that AWS KMS encrypt and decrypt data with any CMK in the specified AWS account and region.
CloudFormationTerraformAWS CLI
An IAM policy that allows IAM users to successfully request that AWS KMS encrypt and decrypt data with a specific CMK.
CloudFormationTerraformAWS CLI
An IAM policy that prevents a user from disabling or deleting any CMKs, even when another IAM policy or a key policy allows these permissions.
CloudFormationTerraformAWS CLI
Service Control Policy
This SCP prevents users or roles in any affected account from deleting KMS keys, either directly as a command or through the console.
CloudFormationTerraformAWS CLI
KMS
Monitoring & Compliance Packages
Config Rule
CloudWatch Alarms
CloudWatch Events
IAM Policy
Service Control Policy