fix(kms): detect public access for any KMS action, not just kms:*

[Copilot]

Context

The kms_key_not_publicly_accessible check failed to detect public access when KMS policies granted specific actions (e.g., kms:DescribeKey) to wildcard principals, despite AWS SecurityHub correctly flagging these as publicly accessible.

Description

Root Cause: The check filtered public access detection to only kms:* wildcard actions via not_allowed_actions=["kms:*"]. The is_policy_public() function performs exact string matching, not pattern matching, so "kms:DescribeKey" ≠ "kms:*".

Fix: Removed not_allowed_actions parameter. Any action with public principal ("Principal": "*" or "Principal": {"AWS": "*"}) is now correctly flagged, aligning with AWS SecurityHub behavior.

# Before: Only caught kms:* wildcard
if is_policy_public(key.policy, account, not_allowed_actions=["kms:*"]):
    report.status = "FAIL"

# After: Catches any action with public principal
if is_policy_public(key.policy, account):
    report.status = "FAIL"

Test Coverage: Added tests for kms:DescribeKey with public principal and multiple specific actions scenarios.

Steps to review

1. Review the single-line change in kms_key_not_publicly_accessible.py
2. Verify test cases cover the reported bug scenario and edge cases
3. Confirm all existing tests pass (no regressions)

Checklist

Community Checklist

• This feature/issue is listed in here or roadmap.prowler.com
• Is it assigned to me, if not, request it via the issue/feature in here or Prowler Community Slack

• Review if the code is being covered by tests.
• Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
• Review if backport is needed.
• Review if is needed to change the Readme.md
• Ensure new entries are added to CHANGELOG.md, if applicable.

SDK/CLI

• Are there new checks included in this PR? No
  • If so, do we need to update permissions for the provider? N/A

UI

• All issue/task requirements work as expected on the UI
• Screenshots/Video of the functionality flow (if applicable) - Mobile (X < 640px)
• Screenshots/Video of the functionality flow (if applicable) - Table (640px > X < 1024px)
• Screenshots/Video of the functionality flow (if applicable) - Desktop (X > 1024px)
• Ensure new entries are added to CHANGELOG.md, if applicable.

API

• All issue/task requirements work as expected on the API
• Endpoint response output (if applicable)
• EXPLAIN ANALYZE output for new/modified queries or indexes (if applicable)
• Performance test results (if applicable)
• Any other relevant evidence of the implementation (if applicable)
• Verify if API specs need to be regenerated.
• Check if version updates are required (e.g., specs, Poetry, etc.).
• Ensure new entries are added to CHANGELOG.md, if applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Bug Report: kms_key_not_publicly_accessible false negative for DescribeKey action</issue_title>
<issue_description>### Issue search

• I have searched the existing issues and this bug has not been reported yet

Which component is affected?

Prowler CLI/SDK

Cloud Provider (if applicable)

AWS

Steps to Reproduce

Create a KMS key with the following policy statement:

json{
"Sid": "AllowDescribeKeyPermissionForClusterOperator",
"Effect": "Allow",
"Principal": {
"AWS": ""
},
"Action": "kms:DescribeKey",
"Resource": ""
}

Run Prowler check:

bashprowler aws --services kms --check-id kms_key_not_publicly_accessible

Observe that Prowler reports the key as NOT publicly accessible
Compare with AWS SecurityHub, which correctly flags this as publicly accessible

Sample Key Policy
json{
"Sid": "AllowDescribeKeyPermissionForClusterOperator",
"Effect": "Allow",
"Principal": {
"AWS": ""
},
"Action": "kms:DescribeKey",
"Resource": ""
}

Expected behavior

The check should flag KMS keys as publicly accessible (FAIL) when the key policy contains:

"Principal": {"AWS": ""} (or "Principal": "")
ANY KMS action (including kms:DescribeKey)
No restrictive condition statements

This aligns with:

AWS SecurityHub control [KMS.2]: "IAM principals should not have IAM inline policies that allow decryption and re-encryption actions on all KMS keys"
AWS best practices that consider ANY unrestricted "Principal": "*" as public access

Actual Result with Screenshots or Logs

The check reports the KMS key as NOT publicly accessible (PASS), even though the policy grants public access to kms:DescribeKey.

How did you install Prowler?

From pip package (pip install prowler)

Environment Resource

AWS CloudShell

OS used

Amazon Linux 2

Prowler version

5.18.2

Python version

N/A

Pip version

N/A

Context

No response</issue_description>

<agent_instructions>Using the comment with the AI assessment, pick the agent plan and implement it.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Bug Report: kms_key_not_publicly_accessible false negative for DescribeKey action #2

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[github-actions]

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

[github-actions]

⚠️ Changes detected in the following folders without a corresponding update to the CHANGELOG.md:

• prowler

Please add an entry to the corresponding CHANGELOG.md file to maintain a clear history of changes.

[Copilot]

Pull request overview

This PR fixes a false negative in the kms_key_not_publicly_accessible security check where KMS keys with specific actions (e.g., kms:DescribeKey) granted to wildcard principals were incorrectly reported as not publicly accessible, despite AWS SecurityHub correctly flagging them as public.

Changes:

• Removed the not_allowed_actions=["kms:*"] parameter from the is_policy_public() call, allowing detection of ANY KMS action with public principals
• Added comprehensive test coverage for the reported bug scenario with both single and multiple specific actions

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
prowler/providers/aws/services/kms/kms_key_not_publicly_accessible/kms_key_not_publicly_accessible.py	Removed not_allowed_actions parameter and added clarifying comment to detect public access for any KMS action, not just wildcard
tests/providers/aws/services/kms/kms_key_not_publicly_accessible/kms_key_not_publicly_accessible_test.py	Added two new test cases covering single action (kms:DescribeKey) and multiple actions scenarios with public principals

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.