KMS KEY POLICY PRIVILEGE ESCALATION

Summary from the TLDR InfoSec newsletter

This post presents an attack chain that could allow an AWS Administrator to override a KMS key policy that was restricted to only a specific identity. In this attack scenario, one admin can lock down a KMS key to their specific use, but another admin can bypass these restrictions by deleting the first admin’s IAM user, changing the contact on the AWS account, and then opening a ticket with AWS support to recover the key. As no identity will be able to access the key, AWS support will then contact the new phone number to verify the request and facilitate the reset. The post ends with some potential mitigations.