Free AI web copilot to create summaries, insights and extended knowledge, download it at here

2379

Abstract

yword">on</span> KMS this <span class="hljs-keyword">role</span> used so we can <span class="hljs-keyword">create</span> an appropriate <span class="hljs-keyword">policy</span>.</pre></div><p id="6806">Well, we can look at CloudTrail again. The question is, will the encryption action be in the local or remote account? Maybe it’s in the remote account and that’s why there’s no link above. But since the role doesn’t exist in the other account we can’t use IAM Access Analyzer over there.</p><div id="50a0"><pre>Fix: ^^^ <span class="hljs-keyword">Show</span> the actions taken <span class="hljs-keyword">in</span> other accounts <span class="hljs-keyword">with</span> IAM <span class="hljs-keyword">access</span> analyzer.</pre></div><p id="ed7f">Well, when I look in the CloudTrail logs in the other account for anything with that key ID I only find the key creation record and no access failure.</p><p id="a15a">When I look in the CloudTrail logs in the account where I’m using the key, I find nothing.</p><p id="d186">I turned on S3 event logs as noted in my last post.</p><p id="6c4f">Those don’t show any KMS actions either, unfortunately.</p><div id="d2c4"><pre><span class="hljs-symbol">Fix:</span> <span class="hljs-keyword">Better </span>documentation <span class="hljs-keyword">or </span>logging for cross-account KMS actions.</pre></div><div id="68ed" class="link-block"> <a href="https://docs.aws.amazon.com/kms/latest/developerguide/security-logging-monitoring.html"> <div> <div> <h2>Logging and monitoring in AWS Key Management Service</h2> <div><h3>Monitoring is an important part of understanding the availability, state, and usage of your AWS KMS keys in AWS KMS…</h3></div> <div><p>docs.aws.amazon.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/)"></div> </div> </div> </a> </div><p id="4394">I guess I need to figure out by trial and error, the minimal actions I need to add to my policy to use the key.</p><p id="4b64">Am I looking in the wrong place, are the logs not there yet, or do they simply not exist? If the logs simply don’t exist for this scenario, that’s a bug.</p><p id="383a">I think the issue may be that these

Options

logs are object-level logs that need to be enabled.</p><div id="0e7a" class="link-block"> <a href="https://docs.aws.amazon.com/kms/latest/developerguide/logging-using-cloudtrail.html?src=radichel"> <div> <div> <h2>Logging AWS KMS API calls with AWS CloudTrail</h2> <div><h3>Learn how to audit AWS KMS keys with AWS CloudTrail.</h3></div> <div><p>docs.aws.amazon.com</p></div> </div> <div> <div style="background-image: url(https://miro.readmedium.com/v2/resize:fit:320/)"></div> </div> </div> </a> </div><p id="a915">I’m going to keep looking for these logs but that’s it for now.</p><p id="7cd8">Follow for updates.</p><p id="4a3a">Teri Radichel | <i>© <a href="https://2ndsightlab.com/?source=post_page---------------------------">2nd Sight Lab</a> 2022</i></p><div id="8b5f"><pre><span class="hljs-section">About Teri Radichel:

⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab</pre></div><div id="caae"><pre><span class="hljs-section">Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation</pre></div><div id="46f6"><pre>Follow <span class="hljs-keyword">for</span> more stories like <span class="hljs-keyword">this</span>:

❤️ Sign Up my Medium Email List ❤️ Twitter: <span class="hljs-meta">@teriradichel</span> ❤️ LinkedIn: https:<span class="hljs-comment">//www.linkedin.com/in/teriradichel</span> ❤️ Mastodon: <span class="hljs-meta">@teriradichel</span><span class="hljs-meta">@infosec</span>.exchange ❤️ Facebook: 2nd Sight Lab ❤️ YouTube: @2ndsightlab</pre></div><figure id="550c"><img src="https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*4oxP4LXk8l8c3mpRvO7ejg.png"><figcaption></figcaption></figure></article></body>

No KMS Cross-Account Logs?

Testing access to a bucket with a cross-account KMS key.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

⚙️ Check out my series on Automating Cybersecurity Metrics | Code.

🔒 Related Stories: Bugs | AWS Security | Secure Code

💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Update — this could be due to the fact that certain KMS actions occur in an unexpected region. I’ve revisted in this in later blog posts in my series above.

I wrote about an access denied message related to PutObject on an S3 bucket. As it turned out and I demonstrated in my last post the error was due to encryption. When I turned doff encryption, no problem. Now I want to figure out exactly what policy I need.

I already showed that I checked the Key Policy in that last post and my account (including the role in it that I’m assuming) has full access to the key used to encrypt the files in the bucket.

Danger — KMS.*

As before to get this working I added KMS * to my IAM Policy as I did with S3 and added the KMS key back to the S3 bucket. That worked. But we’re not done here! As before we want to create a zero-trust policy so let’s see what permissions we really need.

Let’s review IAM Access Analyzer again. Well, this is not helpful. It just shows that KMS was accessed but not which actions.

Fix: ^^^ Show which specific actions on KMS this role used so we can create an appropriate policy.

Well, we can look at CloudTrail again. The question is, will the encryption action be in the local or remote account? Maybe it’s in the remote account and that’s why there’s no link above. But since the role doesn’t exist in the other account we can’t use IAM Access Analyzer over there.

Fix: ^^^ Show the actions taken in other accounts with IAM access analyzer.

Well, when I look in the CloudTrail logs in the other account for anything with that key ID I only find the key creation record and no access failure.

When I look in the CloudTrail logs in the account where I’m using the key, I find nothing.

I turned on S3 event logs as noted in my last post.

Those don’t show any KMS actions either, unfortunately.

Fix: Better documentation or logging for cross-account KMS actions.

Logging and monitoring in AWS Key Management Service

Monitoring is an important part of understanding the availability, state, and usage of your AWS KMS keys in AWS KMS…

docs.aws.amazon.com

I guess I need to figure out by trial and error, the minimal actions I need to add to my policy to use the key.

Am I looking in the wrong place, are the logs not there yet, or do they simply not exist? If the logs simply don’t exist for this scenario, that’s a bug.

I think the issue may be that these logs are object-level logs that need to be enabled.

Logging AWS KMS API calls with AWS CloudTrail

Learn how to audit AWS KMS keys with AWS CloudTrail.

docs.aws.amazon.com

I’m going to keep looking for these logs but that’s it for now.

Follow for updates.

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab