diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index a590361d40..3d417967fb 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -12,6 +12,7 @@ All notable changes to the **Prowler SDK** are documented in this file. ### Changed - Update AWS Glue service metadata to new format [(#9258)](https://github.com/prowler-cloud/prowler/pull/9258) - Update AWS Kafka service metadata to new format [(#9261)](https://github.com/prowler-cloud/prowler/pull/9261) +- Update AWS KMS service metadata to new format [(#9263)](https://github.com/prowler-cloud/prowler/pull/9263) --- diff --git a/prowler/providers/aws/services/kms/kms_cmk_are_used/kms_cmk_are_used.metadata.json b/prowler/providers/aws/services/kms/kms_cmk_are_used/kms_cmk_are_used.metadata.json index ce507ff10a..7165a6d1e1 100644 --- a/prowler/providers/aws/services/kms/kms_cmk_are_used/kms_cmk_are_used.metadata.json +++ b/prowler/providers/aws/services/kms/kms_cmk_are_used/kms_cmk_are_used.metadata.json @@ -1,28 +1,32 @@ { "Provider": "aws", "CheckID": "kms_cmk_are_used", - "CheckTitle": "Check if there are CMK KMS keys not used.", + "CheckTitle": "KMS customer managed key is enabled or scheduled for deletion", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" ], "ServiceName": "kms", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:kms:region:account-id:certificate/resource-id", - "Severity": "medium", + "ResourceIdTemplate": "", + "Severity": "low", "ResourceType": "AwsKmsKey", - "Description": "Check if there are CMK KMS keys not used.", - "Risk": "Unused keys may increase service cost.", + "Description": "**Customer-managed KMS keys** are assessed by key state. Keys in `Enabled` are considered in use. Keys not `Enabled` and not `PendingDeletion` are identified as unused, while those in `PendingDeletion` are recognized as scheduled for removal.", + "Risk": "Keeping **unused CMKs** increases **attack surface** and **cost**.\n\nIf such keys are re-enabled or misconfigured, they can grant unintended decryption, impacting **confidentiality**. Deleting a key mistakenly thought unused can cause **irrecoverable data loss**, harming **availability**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys-determining-usage.html" + ], "Remediation": { "Code": { - "CLI": "aws kms schedule-key-deletion --key-id --pending-window-in-days 7", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws kms enable-key --key-id ", + "NativeIaC": "```yaml\n# CloudFormation: ensure the KMS CMK is enabled\nResources:\n :\n Type: AWS::KMS::Key\n Properties:\n Enabled: true # Critical: enables the key so its state is \"Enabled\" (PASS)\n KeyPolicy:\n Version: '2012-10-17'\n Statement:\n - Sid: Enable IAM User Permissions\n Effect: Allow\n Principal:\n AWS: !Sub arn:aws:iam::${AWS::AccountId}:root\n Action: 'kms:*'\n Resource: '*'\n```", + "Other": "1. Sign in to the AWS Console and open Key Management Service (KMS)\n2. Go to Customer managed keys and select the affected key\n3. Choose Key actions > Enable\n4. Confirm to enable the key", + "Terraform": "```hcl\n# Terraform: ensure the KMS CMK is enabled\nresource \"aws_kms_key\" \"\" {\n is_enabled = true # Critical: sets key state to Enabled (PASS)\n}\n```" }, "Recommendation": { - "Text": "Before deleting a customer master key (CMK), you might want to know how many cipher-texts were encrypted under that key.", - "Url": "https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys-determining-usage.html" + "Text": "Adopt a **key lifecycle**: confirm actual usage with logs, owners, and tags; keep keys `Enabled` only when required; otherwise **schedule deletion** with a waiting period.\n\nEnforce **least privilege** to enable/disable or delete keys, require approvals, and monitor KMS activity with **separation of duties**.", + "Url": "https://hub.prowler.com/check/kms_cmk_are_used" } }, "Categories": [ diff --git a/prowler/providers/aws/services/kms/kms_cmk_not_deleted_unintentionally/kms_cmk_not_deleted_unintentionally.metadata.json b/prowler/providers/aws/services/kms/kms_cmk_not_deleted_unintentionally/kms_cmk_not_deleted_unintentionally.metadata.json index 68609d923f..4c20999703 100644 --- a/prowler/providers/aws/services/kms/kms_cmk_not_deleted_unintentionally/kms_cmk_not_deleted_unintentionally.metadata.json +++ b/prowler/providers/aws/services/kms/kms_cmk_not_deleted_unintentionally/kms_cmk_not_deleted_unintentionally.metadata.json @@ -1,28 +1,34 @@ { "Provider": "aws", "CheckID": "kms_cmk_not_deleted_unintentionally", - "CheckTitle": "AWS KMS keys should not be deleted unintentionally", + "CheckTitle": "AWS KMS customer managed key is not scheduled for deletion", "CheckType": [ - "Data Deletion Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Destruction" ], "ServiceName": "kms", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:kms:region:account-id:certificate/resource-id", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsKmsKey", - "Description": "Ensure there is no customer keys scheduled for deletion.", - "Risk": "KMS keys cannot be recovered once deleted, also, all the data under a KMS key is also permanently unrecoverable if the KMS key is deleted.", - "RelatedUrl": "https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys-scheduling-key-deletion.html", + "Description": "**Customer-managed KMS keys** are evaluated for the `PendingDeletion` state, indicating a scheduled deletion during the mandatory waiting period.", + "Risk": "A key scheduled for deletion can lead to **permanent loss of decryption capability**, degrading **availability** and **integrity** of data and workloads. Accidental or malicious scheduling enables **cryptographic erasure**, causing outages, failed restores, and broken integrations during and after the wait window.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys-scheduling-key-deletion.html", + "https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys-scheduling-key-deletion.html#deleting-keys-scheduling-key-deletion-console" + ], "Remediation": { "Code": { - "CLI": "aws kms cancel-key-deletion --key-id ", + "CLI": "aws kms cancel-key-deletion --key-id ", "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/kms-controls.html#kms-3", + "Other": "1. Sign in to the AWS Management Console and open AWS KMS\n2. Go to Customer managed keys and select the key with status \"Pending deletion\"\n3. Click Key actions > Cancel key deletion\n4. Confirm to cancel; the key status will change from Pending deletion", "Terraform": "" }, "Recommendation": { - "Text": "Cancel the deletion before the end of the period unless you really want to delete that CMK, as it will no longer be usable.", - "Url": "https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys-scheduling-key-deletion.html#deleting-keys-scheduling-key-deletion-console" + "Text": "Prevent unintended deletion:\n- Enforce **least privilege** and **separation of duties** for key admins\n- Require change approvals and alerts on deletion events\n- Prefer **disabling** unused keys over deleting\n- Set sufficient waiting periods and review keys in `PendingDeletion` to verify authorization", + "Url": "https://hub.prowler.com/check/kms_cmk_not_deleted_unintentionally" } }, "Categories": [ diff --git a/prowler/providers/aws/services/kms/kms_cmk_not_multi_region/kms_cmk_not_multi_region.metadata.json b/prowler/providers/aws/services/kms/kms_cmk_not_multi_region/kms_cmk_not_multi_region.metadata.json index c8b603893d..cf7dc565ed 100644 --- a/prowler/providers/aws/services/kms/kms_cmk_not_multi_region/kms_cmk_not_multi_region.metadata.json +++ b/prowler/providers/aws/services/kms/kms_cmk_not_multi_region/kms_cmk_not_multi_region.metadata.json @@ -1,31 +1,38 @@ { "Provider": "aws", "CheckID": "kms_cmk_not_multi_region", - "CheckTitle": "AWS KMS customer managed keys should not be multi-Region", + "CheckTitle": "AWS KMS customer managed key is single-Region", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" ], "ServiceName": "kms", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:kms:region:account-id:key/resource-id", - "Severity": "high", + "ResourceIdTemplate": "", + "Severity": "medium", "ResourceType": "AwsKmsKey", - "Description": "Ensure that AWS KMS customer managed keys (CMKs) are not multi-region to maintain strict data control and compliance with security best practices.", - "Risk": "Multi-region KMS keys can increase the risk of unauthorized access and data exposure, as managing access controls and auditing across multiple regions becomes more complex. This expanded attack surface may lead to compliance violations and data breaches.", - "RelatedUrl": "https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#multi-region-concepts", + "Description": "**AWS KMS customer-managed keys** in an `Enabled` state are assessed for the `multi-Region` setting. The finding highlights keys with the `multi-Region` property enabled.", + "Risk": "Shared key material across Regions lets access in one Region decrypt data from another, eroding **confidentiality** and **data residency**. A misconfigured policy or weaker controls in a replica expand the blast radius. For signing/HMAC keys, compromise enables cross-Region signature forgery, impacting **integrity** and **auditability**.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/kms/latest/developerguide/multi-region-keys-overview.html#multi-region-concepts", + "https://docs.aws.amazon.com/kms/latest/developerguide/mrk-when-to-use.html" + ], "Remediation": { "Code": { - "CLI": "aws kms create-key --no-multi-region", - "NativeIaC": "", - "Other": "", - "Terraform": "resource \"aws_kms_key\" \"example\" { description = \"Single-region key\" multi_region = false }" + "CLI": "", + "NativeIaC": "```yaml\n# CloudFormation: create a single-Region KMS key\nResources:\n ExampleKmsKey:\n Type: AWS::KMS::Key\n Properties:\n MultiRegion: false # Critical: ensures the key is single-Region to pass the check\n KeyPolicy: # Minimal policy required for key creation\n Version: '2012-10-17'\n Statement:\n - Effect: Allow\n Principal:\n AWS: !Sub arn:aws:iam::${AWS::AccountId}:root\n Action: 'kms:*'\n Resource: '*'\n```", + "Other": "1. In the AWS Console, go to Key Management Service (KMS) > Customer managed keys\n2. Identify keys showing Multi-Region: Yes (these FAIL the check)\n3. Click Create key and ensure Multi-Region is not selected (single-Region)\n4. Update your services/aliases to use the new single-Region key\n5. Re-encrypt or rotate data to the new key where required\n6. After migration, disable the old multi-Region key and schedule its deletion", + "Terraform": "```hcl\n# Terraform: create a single-Region KMS key\nresource \"aws_kms_key\" \"example\" {\n multi_region = false # Critical: creates a single-Region key to pass the check\n}\n```" }, "Recommendation": { - "Text": "Identify and replace multi-region keys with single-region KMS keys to enhance security and access control.", - "Url": "https://docs.aws.amazon.com/kms/latest/developerguide/mrk-when-to-use.html" + "Text": "Prefer **single-Region keys** by default; use **multi-Region** only with a documented need. Apply **least privilege** and **separation of duties**; limit who can create or replicate such keys. Isolate per Region/tenant/workload, standardize policy and logging across Regions, and retire multi-Region keys where unnecessary.", + "Url": "https://hub.prowler.com/check/kms_cmk_not_multi_region" } }, - "Categories": [], + "Categories": [ + "encryption" + ], "DependsOn": [], "RelatedTo": [], "Notes": "Multi-region keys should be used only when absolutely necessary, such as for cross-region disaster recovery, and should be carefully managed with strict access controls." diff --git a/prowler/providers/aws/services/kms/kms_cmk_rotation_enabled/kms_cmk_rotation_enabled.metadata.json b/prowler/providers/aws/services/kms/kms_cmk_rotation_enabled/kms_cmk_rotation_enabled.metadata.json index 16517826e4..00efa2b9ca 100644 --- a/prowler/providers/aws/services/kms/kms_cmk_rotation_enabled/kms_cmk_rotation_enabled.metadata.json +++ b/prowler/providers/aws/services/kms/kms_cmk_rotation_enabled/kms_cmk_rotation_enabled.metadata.json @@ -1,28 +1,34 @@ { "Provider": "aws", "CheckID": "kms_cmk_rotation_enabled", - "CheckTitle": "Ensure rotation for customer created KMS CMKs is enabled.", + "CheckTitle": "KMS customer-managed symmetric CMK has automatic rotation enabled", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "kms", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:kms:region:account-id:certificate/resource-id", - "Severity": "medium", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsKmsKey", - "Description": "Ensure rotation for customer created KMS CMKs is enabled.", - "Risk": "Cryptographic best practices discourage extensive reuse of encryption keys. Consequently, Customer Master Keys (CMKs) should be rotated to prevent usage of compromised keys.", - "RelatedUrl": "https://aws.amazon.com/blogs/security/how-to-get-ready-for-certificate-transparency/", + "Description": "**Customer-managed KMS symmetric keys** in the `Enabled` state are evaluated to confirm `automatic rotation` of key material is configured", + "Risk": "Without **automatic rotation**, long-lived key material increases confidentiality and integrity risk. If a KMS key is exposed, attackers can unwrap data keys and decrypt stored data until the key changes. It also reduces crypto agility and may conflict with mandated rotation policies.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html", + "https://aws.amazon.com/blogs/security/how-to-get-ready-for-certificate-transparency/" + ], "Remediation": { "Code": { - "CLI": "aws kms enable-key-rotation --key-id ", - "NativeIaC": "", - "Other": "", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-kms-have-rotation-policy#terraform" + "CLI": "aws kms enable-key-rotation --key-id ", + "NativeIaC": "```yaml\n# CloudFormation: KMS key with automatic rotation enabled\nResources:\n :\n Type: AWS::KMS::Key\n Properties:\n EnableKeyRotation: true # Critical: enables automatic rotation so the key passes the check\n KeyPolicy:\n Version: \"2012-10-17\"\n Statement:\n - Effect: Allow\n Principal:\n AWS: !Sub arn:aws:iam::${AWS::AccountId}:root\n Action: \"kms:*\"\n Resource: \"*\"\n```", + "Other": "1. In the AWS Console, go to Key Management Service (KMS)\n2. Open Customer managed keys and select the enabled symmetric key\n3. Go to the Key rotation section\n4. Check Enable automatic key rotation\n5. Save changes", + "Terraform": "```hcl\n# KMS key with automatic rotation enabled\nresource \"aws_kms_key\" \"\" {\n enable_key_rotation = true # Critical: enables automatic rotation so the key passes the check\n}\n```" }, "Recommendation": { - "Text": "For every KMS Customer Master Keys (CMKs), ensure that Rotate this key every year is enabled.", - "Url": "https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html" + "Text": "Enable **automatic rotation** on customer-managed symmetric KMS keys and choose a rotation period that meets policy. Enforce **least privilege** and **separation of duties** for key administration versus usage. Monitor key lifecycle events and use on-demand rotation when compromise is suspected.", + "Url": "https://hub.prowler.com/check/kms_cmk_rotation_enabled" } }, "Categories": [ diff --git a/prowler/providers/aws/services/kms/kms_key_not_publicly_accessible/kms_key_not_publicly_accessible.metadata.json b/prowler/providers/aws/services/kms/kms_key_not_publicly_accessible/kms_key_not_publicly_accessible.metadata.json index 563cef94c3..ab6a060fe1 100644 --- a/prowler/providers/aws/services/kms/kms_key_not_publicly_accessible/kms_key_not_publicly_accessible.metadata.json +++ b/prowler/providers/aws/services/kms/kms_key_not_publicly_accessible/kms_key_not_publicly_accessible.metadata.json @@ -1,33 +1,41 @@ { "Provider": "aws", "CheckID": "kms_key_not_publicly_accessible", - "CheckTitle": "Check exposed KMS keys", + "CheckTitle": "Cloud KMS key does not grant access to allUsers or allAuthenticatedUsers", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access/Unauthorized Access", + "Effects/Data Exposure" ], "ServiceName": "kms", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:kms:region:account-id:certificate/resource-id", - "Severity": "medium", + "ResourceIdTemplate": "", + "Severity": "critical", "ResourceType": "AwsKmsKey", - "Description": "Check exposed KMS keys", - "Risk": "Exposed KMS Keys or wide policy permissions my leave data unprotected.", - "RelatedUrl": "https://docs.aws.amazon.com/kms/latest/developerguide/determining-access.html", + "Description": "**KMS keys** are assessed for **excessive access** in key policies or grants, including `*` principals and broadly scoped permissions to multiple identities.", + "Risk": "Broad access to a **KMS key** enables unauthorized `kms:Decrypt` and data-key generation, breaking **confidentiality**. With admin rights, attackers can change policies or schedule deletion, undermining control **integrity** and threatening **availability** of data dependent on the key.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudKMS/publicly-accessible-kms-cryptokeys.html", + "https://support.icompaas.com/support/solutions/articles/62000232904-1-9-ensure-cloud-kms-cryptokeys-are-not-accessible-to-anonymous-or-public-users-automated-", + "https://docs.aws.amazon.com/kms/latest/developerguide/determining-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://github.com/cloudmatos/matos/tree/master/remediations/aws/kms/exposed-key", - "Terraform": "" + "CLI": "aws kms put-key-policy --key-id --policy-name default --policy '{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam:::root\"},\"Action\":\"kms:*\",\"Resource\":\"*\"}]}'", + "NativeIaC": "```yaml\n# CloudFormation: restrict KMS key policy to account root (removes any public access)\nResources:\n :\n Type: AWS::KMS::Key\n Properties:\n KeyPolicy:\n Version: '2012-10-17'\n Statement:\n - Effect: Allow\n Principal:\n AWS: arn:aws:iam:::root # Critical: only account root can access; prevents public \"*\" principals\n Action: kms:*\n Resource: '*'\n```", + "Other": "1. Open AWS Console > Key Management Service (KMS)\n2. Select the affected key and go to the Key policy tab\n3. Click Edit and remove any statement with Principal set to \"*\" (or AWS: \"*\")\n4. Ensure a statement exists that allows only arn:aws:iam:::root\n5. Save changes", + "Terraform": "```hcl\n# Restrict KMS key policy to the account root to avoid any public (\"*\") principals\ndata \"aws_caller_identity\" \"current\" {}\n\nresource \"aws_kms_key\" \"\" {\n policy = jsonencode({\n Version = \"2012-10-17\"\n Statement = [\n {\n Effect = \"Allow\"\n Principal = { AWS = \"arn:aws:iam::${data.aws_caller_identity.current.account_id}:root\" } # Critical: limit to account root to remove public access\n Action = \"kms:*\"\n Resource = \"*\"\n }\n ]\n })\n}\n```" }, "Recommendation": { - "Text": "To determine the full extent of who or what currently has access to a customer master key (CMK) in AWS KMS, you must examine the CMK key policy, all grants that apply to the CMK and potentially all AWS Identity and Access Management (IAM) policies. You might do this to determine the scope of potential usage of a CMK.", - "Url": "https://docs.aws.amazon.com/kms/latest/developerguide/determining-access.html" + "Text": "Apply **least privilege** to KMS keys:\n- Restrict principals to specific roles and accounts\n- Prefer narrow, time-bound grants\n- Separate key administration from usage\n- Use conditions to limit context\n- Review regularly and remove wildcard or cross-account exposure", + "Url": "https://hub.prowler.com/check/kms_key_not_publicly_accessible" } }, "Categories": [ "internet-exposed", - "encryption" + "identity-access" ], "DependsOn": [], "RelatedTo": [],