其他AWS用户（不正确）能够访问我的AWS SecretsManager秘密值，该值用我的AWS KMS CMK加密

Question

• 我的KMS CMK策略规定，只有我可以执行KMS:decrypt。
• 我的同事（在我的CMK上没有这些权限）可以...
  • 打开SecretsManager的AWS控制台>>>
  • 单击检索机密值>>>
  • 查看我的秘密值！

  知道为什么吗？

  技术细节：

  AWSTemplateFormatVersion: "2010-09-09"
  Transform: AWS::Serverless-2016-10-31
  
  Parameters:
    SecretValue:
      Type: String
    KmsCmkId: 
      Type: String
  
  Resources:
    MySecret:
      Type: AWS::SecretsManager::Secret
      Properties:
        SecretString:
          Ref: SecretValue
        KmsKeyId: !Ref KmsCmkId
  

  sam build ; sam deploy --guided --parameter-overrides SecretValue=ABC KmsCmkId=REDACTED
  

  我确认单击AWS SecretsManager控制台中的Retrieve Secret Value按钮确实执行了带有SecretsManager:getSecretValue的API调用。

  AWS说，SecretsManager:getSecretValue只有在调用方在用于加密秘密的CMK上也有kms:decrypt的情况下才会起作用（这是有道理的）。（请参阅https://docs.aws.amazon.com/secretsmanager/latest/apireference/api_getsecretvalue.html)

  我确认我的对称KMS CMK确实是被用来加密秘密的CMK。

  注意：注意不要将kms:get*操作与secretsmanager:get*操作混淆。

  以下是我的KMS CMK策略：

  {
      "Id": "key-consolepolicy-3",
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "Enable IAM User Permissions",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::REDACTED:root"
              },
              "Action": "kms:*",
              "Resource": "*"
          },
          {
              "Sid": "Allow access for Key Administrators",
              "Effect": "Allow",
              "Principal": {
                  "AWS": [
                      "arn:aws:iam::REDACTED:user/MY_COWORKER"
                  ]
              },
              "Action": [
                  "kms:Create*",
                  "kms:Describe*",
                  "kms:Enable*",
                  "kms:List*",
                  "kms:Put*",
                  "kms:Update*",
                  "kms:Revoke*",
                  "kms:Disable*",
                  "kms:Get*",
                  "kms:Delete*",
                  "kms:TagResource",
                  "kms:UntagResource",
                  "kms:ScheduleKeyDeletion",
                  "kms:CancelKeyDeletion"
              ],
              "Resource": "*"
          },
          {
              "Sid": "Allow use of the key",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::REDACTED:user/ME"
              },
              "Action": [
                  "kms:Encrypt",
                  "kms:Decrypt",
                  "kms:ReEncrypt*",
                  "kms:GenerateDataKey*",
                  "kms:DescribeKey"
              ],
              "Resource": "*"
          },
          {
              "Sid": "Allow attachment of persistent resources",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::REDACTED:user/ME"
              },
              "Action": [
                  "kms:CreateGrant",
                  "kms:ListGrants",
                  "kms:RevokeGrant"
              ],
              "Resource": "*",
              "Condition": {
                  "Bool": {
                      "kms:GrantIsForAWSResource": "true"
                  }
              }
          }
      ]
  }
  

Answer 1

非常感谢@JohnRotenstein，他给我指明了正确的方向，并回答了我的问题，如上图所示！

我刚发现下面的答案有问题。我正在调查和修复。我会更新我的答案在这里，当它是固定的。请忽略下面的答案，直到我修复它并删除此警告消息。

正如John所问的，当我在上面说我的同事在我们的帐户上“是管理员”时，我的意思是他的IAM用户帐户具有AWS托管策略管理员访问（据我所知），该策略给予AWS（包括KMS！！）中的所有内容或几乎所有内容的“完全访问”。

json prettyprint-override">{
    "Sid": "Deny use of the key (such as to encrypt and decrypt) for everyone",
    "Effect": "Deny",
    "Principal": "*",
    "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*"
    ],
    "Resource": "*"
},