We are using MSK SCRAM which registers Secrets Manager secrets for authentication. This does require a separate symmetric KMS key to be used with the secrets. The secrets are required to be of the form 'AmazonMSK_*'. Security is asking to get the access to this KMS key down to the minimum privilege in the KMS key policy.
It seems the recommendation is to use Condition variables. Link : https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html
I have tried to use this in this manner:
Effect: Allow
Action:
-kms:CreateGrant
- kms:Encrypt
Resource: ""
Principal: ""
Condition:
StringLike:
kms:EncryptionContext:aws:secretsmanager:arn:
- "arn.aws.secretsmanager:us-west-2::secret:AmazonMSK_"
but i get : "Access to KMS is not allowed"
a condition such as :
Condition:
StringEquals:
kms:ViaService: "secretsmanager.us-west-2.amazonaws.com"
works, but is not specific enough. Does someone know what EncryptionContext could be used for
secretsmanager conditions?
