Another AWS Documentation Misleading Policy
Granting access to a KMS key for an organization or specific OUs
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⚙️ Check out my series on Automating Cybersecurity Metrics | Code.
🔒 Related Stories: Bugs | AWS Security | Secure Code
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The statement above the policy in the documentation below is misleading
Yes, it grants access to the OU, but also the entire organization. The documentation should make that clearer.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*jL0OEf98_FEbQTNp_JLJxQ.png)
This would be to LIMIT access to specific OUs.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*pldJvMRO5HdWiO8cKwk-rg.png)
Keep finding subtle errors like this throughout the documentation. This documentation is on the EC2 page. It should probably be on the KMS page and linked to from the EC2 page. People who are experts in KMS policies should be reviewing it.
This is not the first time I’ve found misleading policy documentation.
Looks like this one got fixed finally — I think.
BoolIfExists for MFA — Just Say No
ACM.368 A better policy to require MFA for ALL actions
medium.com
I’m not sure if it got fixed everywhere that statement is made, however, and that’s the problem with lack of abstraction and centralization of documentation, the same way you leverage abstraction for code or security.
Follow for updates.
Teri Radichel | © 2nd Sight Lab 2023
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab
Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation
Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*4oxP4LXk8l8c3mpRvO7ejg.png)