AWS KMS

AWS security controls to create AWS KMS keys and help protect AWS KMS.

Configuration to create an AWS KMS Customer Master Key (CMK).

Configuration to create an AWS KMS Customer Master Key (CMK) with automatic key rotation enabled.

A configuration package to monitor KMS related API activity as well as configuration compliance rules to ensure the security of AWS KMS configuration. The package includes Config Rules, CloudWatch Alarms, and Clo...

A config rule that checks that key rotation is enabled for each customer master key (CMK). The rule is COMPLIANT, if the key rotation is enabled for specific key object. The rule is not applicable to CMKs that ha...

A config rule that checks that Customer Managed keys are not scheduled for deletion

Alarm if customer created CMKs get disabled or scheduled for deletion.

A CloudWatch Alarm that triggers on changes to customer created CMKs: Key creation, deletion, or enabling/disabling operations, as well as updates to CMK Key policies.

A CloudWatch Event Rule that detects KMS Customer Master Key (CMK) changes and publishes change events to an SNS topic for notification.

A CloudWatch Event Rule that triggers on AWS KMS Customer Master Key (CMK) deletion events.

A CloudWatch Event Rule that triggers on AWS KMS Customer Master Key (CMK) rotation events.

A CloudWatch Event Rule that triggers on AWS KMS Customer Master Key (CMK) imported material expiration events.

An IAM policy that allows IAM users read-only access to the AWS KMS console. That is, users can use the console to view all CMKs, but they cannot make changes to any CMKs or create new ones.

An IAM policy that allows IAM users to successfully request that AWS KMS encrypt and decrypt data with any CMK in the specified AWS account and region.

An IAM policy that allows IAM users to successfully request that AWS KMS encrypt and decrypt data with a specific CMK.

An IAM policy that prevents a user from disabling or deleting any CMKs, even when another IAM policy or a key policy allows these permissions.

This SCP prevents users or roles in any affected account from deleting KMS keys, either directly as a command or through the console.