KMS grant policy get different behavior between SSM automation and boto3

Question

I have an ec2 AMI with an encrypted EBS snapshot. I have the below policy. If I use lambda boto3 to start instance then it can start instance. But If I use SSM automation runbook like updateLinuxAMI, the below policy won't work. In order to work, I have to remove the condition phase. Does anyone know the reason for this ?
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kms:CreateGrant",
                "kms:DescribeKey",
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:RetireGrant"
            ],
            "Resource": "arn:aws:kms:ap-northeast-1::key/aexxxx-xxxx-xxxx",
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": "true"
                }
            }
        }
    ]
}

Leo K · Accepted Answer

Your policy can't work because you've combined two statements with conflicting requirements.

The `kms:GrantIsForAWSResource` condition key required to be present with a true value is now applied to the whole statement, but the key only applies to the `kms:CreateGrant` permission.

The other actions, `kms:DescribeKey`, `kms:Decrypt`, `kms:Encrypt`, `kms:ReEncrypt*`, `kms:GenerateDataKey*`, `kms:RetireGrant`, never contain the `kms:GrantIsForAWSResource` key, so whenever an action requiring one of those permissions is attempted, it is denied implicitly due to the condition not being satisfied.

You'll need to separate the permissions (actions) other than `kms:CreateGrant` into a separate statement without a `Condition` block:
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["kms:DescribeKey","kms:Decrypt","kms:Encrypt","kms:ReEncrypt*","kms:GenerateDataKey*","kms:RetireGrant"],
      "Resource": "arn:aws:kms:ap-northeast-1::key/aexxxx-xxxx-xxxx"
    },
    {
      "Effect": "Allow",
      "Action": "kms:CreateGrant",
      "Resource": "arn:aws:kms:ap-northeast-1::key/aexxxx-xxxx-xxxx",
      "Condition": {
        "Bool": {
          "kms:GrantIsForAWSResource": "true"
        }
      }
    }    
  ]
}
```

Gary Mclean · Answer

I dont think its down to the EBS Encryption. It may be down to the execution Role that calling the EC2 Start Instance.
You can check cloudtrail to confirm what role is being used and where its being denied.

The AWS-UpdateLinuxAMi updates an Amazon Machine Image (AMI) with Linux distribution packages and Amazon software. I dont believe it will start the EC2!

Also the run book has Assume Role Parameter:-

```
AutomationAssumeRole
Type: String
Description: (Optional) The Amazon Resource Name (ARN) of the AWS Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf. If no role is specified, Systems Manager Automation uses the permissions of the user that starts this runbook.
```

Ensure your runbook is using the correct Role/Permissions

KMS grant policy get different behavior between SSM automation and boto3

Add your answer

Relevant content