Devolutions.CIEM

0.3.28

Checks/Aws/Test-IamPolicyNoFullAccessToKms.ps1

                                function Test-IamPolicyNoFullAccessToKms {

    <#

    .SYNOPSIS

        Custom IAM policy does not allow 'kms:*' privileges

    .DESCRIPTION

        **Customer-managed IAM policies** are examined for statements that grant **AWS KMS** full access using `kms:*`. The focus is on policies allowing service-wide actions rather than narrowly scoped, key-specific permissions.

    .PARAMETER Check

        CIEMCheck object containing check metadata.

    #>

    [CmdletBinding()]

    [OutputType([PSCustomObject[]])]

    param(

        [Parameter(Mandatory)]

        [CIEMCheck]$Check

    )

    $ErrorActionPreference = 'Stop'

    # TODO: Implement check logic based on Prowler check: iam_policy_no_full_access_to_kms

    [CIEMScanResult]::Create($Check, 'MANUAL', 'This check requires manual implementation. See Prowler check iam_policy_no_full_access_to_kms for reference.', 'N/A', 'iam Resources')

}