{
  "Provider": "aws",
  "CheckID": "kms_key_not_publicly_accessible",
  "CheckTitle": "Check exposed KMS keys",
  "CheckType": [
    "Data Protection"
  ],
  "ServiceName": "kms",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:kms:region:account-id:certificate/resource-id",
  "Severity": "medium",
  "ResourceType": "AwsKmsKey",
  "Description": "Check exposed KMS keys",
  "Risk": "Exposed KMS Keys or wide policy permissions my leave data unprotected.",
  "RelatedUrl": "https://docs.aws.amazon.com/kms/latest/developerguide/determining-access.html",
  "Remediation": {
    "Code": {
      "CLI": "",
      "NativeIaC": "",
      "Other": "https://github.com/cloudmatos/matos/tree/master/remediations/aws/kms/exposed-key",
      "Terraform": ""
    },
    "Recommendation": {
      "Text": "To determine the full extent of who or what currently has access to a customer master key (CMK) in AWS KMS, you must examine the CMK key policy, all grants that apply to the CMK and potentially all AWS Identity and Access Management (IAM) policies. You might do this to determine the scope of potential usage of a CMK.",
      "Url": "https://docs.aws.amazon.com/kms/latest/developerguide/determining-access.html"
    }
  },
  "Categories": [
    "internet-exposed"
  ],
  "Tags": {
    "Tag1Key": "value",
    "Tag2Key": "value"
  },
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": ""
}
