AWS KMS

AWS security controls to create AWS KMS keys and help protect AWS KMS.

Configuration to create an AWS KMS Customer Master Key (CMK).

Configuration to create an AWS KMS Customer Master Key (CMK) with automatic key rotation enabled.

A config rule that checks that key rotation is enabled for each customer master key (CMK). The rule is COMPLIANT, if the key rotation is enabled for specific key object. The rule is not applicable to CMKs that ha...

Alarm if customer created CMKs get disabled or scheduled for deletion.

An IAM policy that allows IAM users read-only access to the AWS KMS console. That is, users can use the console to view all CMKs, but they cannot make changes to any CMKs or create new ones.

An IAM policy that allows IAM users to successfully request that AWS KMS encrypt and decrypt data with any CMK in the specified AWS account and region.

An IAM policy that allows IAM users to successfully request that AWS KMS encrypt and decrypt data with a specific CMK.

An IAM policy that prevents a user from disabling or deleting any CMKs, even when another IAM policy or a key policy allows these permissions.

This SCP prevents users or roles in any affected account from deleting KMS keys, either directly as a command or through the console.