Find KMS Keys With a Wildcard Key Policy Principal or Open Grants

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListKeysAndAliases",
      "Effect": "Allow",
      "Action": [
        "kms:ListKeys",
        "kms:ListAliases"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ReadKeyPoliciesAndGrants",
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:GetKeyPolicy",
        "kms:ListGrants"
      ],
      "Resource": "arn:aws:kms:*:111122223333:key/*"
    }
  ]
}

// find-kms-keys-with-open-key-policies.ts
// Checks every customer managed KMS key in a Region for key policy statements that allow a wildcard
// principal ("*" or {"AWS": "*"}), statements that allow other AWS accounts, and grants whose grantee
// is in another account. Report only: it never changes a key policy or revokes a grant.
// Usage:
//   npx tsx find-kms-keys-with-open-key-policies.ts [--region eu-west-1] [--skip-grants]
import {
  DescribeKeyCommand,
  GetKeyPolicyCommand,
  KMSClient,
  paginateListAliases,
  paginateListGrants,
  paginateListKeys,
} from "@aws-sdk/client-kms";
import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const region = flag("--region") ?? process.env.AWS_REGION ?? "us-east-1";
const skipGrants = args.includes("--skip-grants");
const kms = new KMSClient({ region });

interface Statement {
  Sid?: string;
  Effect?: string;
  Principal?: unknown;
  NotPrincipal?: unknown;
  Action?: string | string[];
  Condition?: Record<string, Record<string, unknown>>;
}

interface Finding {
  Key: string;
  Alias: string;
  Severity: "HIGH" | "REVIEW";
  Finding: string;
  Principal: string;
  Detail: string;
}

const list = (v: unknown): string[] => (v === undefined ? [] : Array.isArray(v) ? v.map(String) : [String(v)]);

// Returns the AWS principals of a statement; "*" stands for everyone.
function awsPrincipals(p: unknown): string[] {
  if (p === "*") return ["*"];
  if (p && typeof p === "object" && "AWS" in p) return list((p as { AWS: unknown }).AWS);
  return []; // Service or Federated principals are left out.
}

// 12-digit account ID from "111122223333" or "arn:aws:iam::111122223333:role/x"; undefined for "*".
function accountOf(principal: string): string | undefined {
  if (/^\d{12}$/.test(principal)) return principal;
  return /^arn:aws[\w-]*:(?:iam|sts)::(\d{12}):/.exec(principal)?.[1];
}

const conditionKeys = (s: Statement): string =>
  Object.values(s.Condition ?? {})
    .flatMap((c) => Object.keys(c))
    .join(", ");

async function checkKey(keyId: string, base: { Key: string; Alias: string }, me: string | undefined): Promise<Finding[]> {
  const out: Finding[] = [];
  const { Policy } = await kms.send(new GetKeyPolicyCommand({ KeyId: keyId, PolicyName: "default" }));
  const doc = JSON.parse(Policy ?? "{}") as { Statement?: Statement | Statement[] };
  const statements = Array.isArray(doc.Statement) ? doc.Statement : doc.Statement ? [doc.Statement] : [];
  for (const s of statements) {
    if (s.Effect !== "Allow") continue;
    const sid = s.Sid ?? "(no Sid)";
    const actions = list(s.Action).join(", ");
    if (s.NotPrincipal !== undefined) {
      out.push({ ...base, Severity: "HIGH", Finding: "Allow with NotPrincipal", Principal: "everyone except listed", Detail: `${sid}: ${actions}` });
      continue;
    }
    for (const p of awsPrincipals(s.Principal)) {
      const conds = conditionKeys(s);
      if (p === "*") {
        out.push({
          ...base,
          Severity: conds ? "REVIEW" : "HIGH",
          Finding: conds ? "wildcard principal with conditions" : "wildcard principal, no conditions",
          Principal: "*",
          Detail: `${sid}: ${actions}${conds ? ` | conditions: ${conds}` : ""}`,
        });
        continue;
      }
      const account = accountOf(p);
      if (account && account !== me) {
        out.push({ ...base, Severity: "REVIEW", Finding: "other account in key policy", Principal: p, Detail: `${sid}: ${actions}` });
      }
    }
  }

  if (skipGrants) return out;
  for await (const gPage of paginateListGrants({ client: kms }, { KeyId: keyId })) {
    for (const g of gPage.Grants ?? []) {
      const grantee = g.GranteePrincipal ?? "";
      const account = accountOf(grantee);
      if (account && account !== me) {
        out.push({
          ...base,
          Severity: "REVIEW",
          Finding: "grant to other account",
          Principal: grantee,
          Detail: `${g.GrantId?.slice(0, 12)}...: ${(g.Operations ?? []).join(", ")}${g.RetiringPrincipal ? ` | retiring: ${g.RetiringPrincipal}` : ""}`,
        });
      }
    }
  }
  return out;
}

async function main(): Promise<void> {
  const { Account: me } = await new STSClient({ region }).send(new GetCallerIdentityCommand({}));
  const aliases = new Map<string, string>();
  for await (const page of paginateListAliases({ client: kms }, {})) {
    for (const a of page.Aliases ?? []) if (a.TargetKeyId && a.AliasName) aliases.set(a.TargetKeyId, a.AliasName);
  }

  const findings: Finding[] = [];
  let customerKeys = 0;
  for await (const page of paginateListKeys({ client: kms }, {})) {
    for (const k of page.Keys ?? []) {
      if (!k.KeyId) continue;
      const base = { Key: k.KeyId, Alias: aliases.get(k.KeyId) ?? "-" };
      try {
        const { KeyMetadata: meta } = await kms.send(new DescribeKeyCommand({ KeyId: k.KeyId }));
        if (meta?.KeyManager !== "CUSTOMER") continue; // AWS managed keys have policies you can't edit.
        customerKeys++;
        findings.push(...(await checkKey(k.KeyId, base, me)));
      } catch (err) {
        // A key policy that doesn't let your role read it is itself worth a look.
        findings.push({ ...base, Severity: "REVIEW", Finding: "could not read key", Principal: "-", Detail: err instanceof Error ? err.name : String(err) });
      }
    }
  }

  console.log(`Account ${me}, ${region}: ${customerKeys} customer managed keys, ${findings.length} findings`);
  findings.sort((a, b) => a.Severity.localeCompare(b.Severity));
  if (findings.length) console.table(findings);
  console.log("Report only. Change key policies with PutKeyPolicy and remove grants with RevokeGrant after review.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-kms @aws-sdk/client-sts
npm install --save-dev tsx typescript @types/node

AWS_PROFILE=security-audit npx tsx find-kms-keys-with-open-key-policies.ts --region us-east-1

# Key policies only, skip grants
AWS_PROFILE=security-audit npx tsx find-kms-keys-with-open-key-policies.ts --region eu-west-1 --skip-grants

Account 111122223333, us-east-1: 2 customer managed keys, 5 findings
┌─────────┬────────────────────────────────────────┬────────────────────────┬──────────┬──────────────────────────────────────┬──────────────────────────────────────┬───────────────────────────────────────────────────────────────────────────┐
│ (index) │ Key                                    │ Alias                  │ Severity │ Finding                              │ Principal                            │ Detail                                                                    │
├─────────┼────────────────────────────────────────┼────────────────────────┼──────────┼──────────────────────────────────────┼──────────────────────────────────────┼───────────────────────────────────────────────────────────────────────────┤
│ 0       │ '1234abcd-12ab-34cd-56ef-1234567890ab' │ 'alias/shared-backups' │ 'HIGH'   │ 'wildcard principal, no conditions'  │ '*'                                  │ 'Allow use: kms:Decrypt, kms:DescribeKey'                                 │
│ 1       │ '1234abcd-12ab-34cd-56ef-1234567890ab' │ 'alias/shared-backups' │ 'REVIEW' │ 'other account in key policy'        │ 'arn:aws:iam::444455556666:root'     │ 'Partner: kms:Decrypt'                                                    │
│ 2       │ '1234abcd-12ab-34cd-56ef-1234567890ab' │ 'alias/shared-backups' │ 'REVIEW' │ 'other account in key policy'        │ '555566667777'                       │ 'Partner: kms:Decrypt'                                                    │
│ 3       │ '0b7c6d5e-4f3a-4b2c-8d1e-9f0a1b2c3d4e' │ '-'                    │ 'REVIEW' │ 'wildcard principal with conditions' │ '*'                                  │ 'Org: kms:Decrypt | conditions: aws:PrincipalOrgID'                       │
│ 4       │ '0b7c6d5e-4f3a-4b2c-8d1e-9f0a1b2c3d4e' │ '-'                    │ 'REVIEW' │ 'grant to other account'             │ 'arn:aws:iam::444455556666:role/etl' │ '6f1f2a8b9c0d...: Decrypt | retiring: arn:aws:iam::444455556666:role/etl' │
└─────────┴────────────────────────────────────────┴────────────────────────┴──────────┴──────────────────────────────────────┴──────────────────────────────────────┴───────────────────────────────────────────────────────────────────────────┘
Report only. Change key policies with PutKeyPolicy and remove grants with RevokeGrant after review.