Entry to KMS is Not Allowed: Workaround | by Teri Radichel | Bugs That Chunk | Sep, 2022 | Energy Tech

Overcome the issue when AWS overwrites your KMS operate with a meaningless worth

I have been engaged on this automation sequence and have written about various points with KMS that I hope AWS will repair. One is the truth that they overwrite your key coverage roles with a meaningless worth in case you delete or change a job.

This can be a huge downside for a number of causes:

• CloudFormation doesn’t acknowledge that your template and stack are old-fashioned and won’t replace to the proper operate.
• You could not have the ability to totally handle the important thing if the admin function is eliminated.
• You could get an unhelpful error: “KMS entry isn’t allowed” when attempting to carry out CloudFormation updates on any stack that makes use of that key. That is not correct as a result of the IAM coverage permits entry to KMS. The issue is that the important thing coverage now not has that function. Since you do not see some other errors in your stack, it is not instantly clear what the issue is.

To get round this downside with a sequence of coordinated templates that I deploy collectively for my newest weblog sequence, I found that if I modify an arbitrary output parameter created solely to pressure a refresh, I can get the important thing to redeploy although nothing else has completed it. . change. The important thing coverage references one other output from the CloudFormation stack, and due to this fact the template itself doesn’t change even when the opposite output adjustments.

I created a parameter to go a timestamp:

I pull out the timestamp to pressure CloudFormation to replace:

Since AWS CloudFormation isn’t dealing with areas appropriately presently, I eliminated the areas from my timestamp and enclosed them in quotes.

This isn’t a superb resolution as a result of I’m probably paying for extra runs than I actually need. AWS actually should not change key buyer insurance policies. Perhaps they are often disabled till they’re up to date and glued or they warn the client ultimately, however do not change the client’s insurance policies. AWS does not usually contact buyer information, so that is very unusual.

For extra info on automated KMS creation and KMS insurance policies, take a look at this sequence of weblog posts and associated code on GitHub.

Teri Radichel

In case you like this story please applaud and proceed:

Medium: Teri Radichel or Electronic mail Checklist: Teri Radichel
Twitter: @teriradichel or @2ndSightLab
Requests providers by way of LinkedIn: Teri Radichel or IANS Analysis

© second sight lab 2022

_____________________________________________

Creator:

Cybersecurity for executives within the cloud period at Amazon

Do you want cloud safety coaching? 2nd Sight Lab Cloud Safety Coaching

Is your cloud safe? Rent 2nd Sight Lab for a penetration check or safety evaluation.

Do you might have a query about cybersecurity or cloud safety? Ask Teri Radichel by scheduling a name with IANS Analysis.

Cybersecurity and Cloud Safety Sources by Teri Radichel: Cybersecurity and cloud safety courses, articles, white papers, shows, and podcasts