The role that can read S3 but not the secret | Labs | DevOps in Practice

The reporting job can download an encrypted object from S3, but fails when AWS KMS tries to decrypt its data key.

Read the failing API call and identify which authorization layer denied it.

Try: aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=Decrypt

Terminal command

The reporting role can decrypt only its data.

The exact KMS request is allowed without granting wildcard decrypt access.

Lesson

Trace AccessDenied to the API that actually rejected the call. For KMS, scope permissions by key and encryption context so a necessary decrypt grant does not become a general-purpose decryption capability.

Edit reporting-kms-policy.tf

Scope the permission to the reporting key and the reports/ object prefix.

Allow only kms:Decrypt on arn:aws:kms:ap-northeast-1:123456789012:key/reporting with the reports/* S3 encryption context.

Key concepts

One request can cross authorization boundaries

Reading encrypted S3 data also requires permission from KMS.

What it is

SSE-KMS stores an encrypted data key with the object and calls KMS to decrypt it for authorized readers.

In this incident

s3:GetObject succeeds, then kms:Decrypt fails.

Why it matters

The last visible service is not always the service denying the operation.

Least privilege includes resource and context

Action-only policies are usually too broad.

What it is

IAM can restrict an allowed action to a specific resource and request conditions.

In this incident

Decrypt is limited to one KMS key and S3 objects under reports/.

Why it matters

A compromised reporting job cannot use the permission to decrypt unrelated workloads.

Policy simulation is a focused verification

It evaluates authorization without running the production job.

What it is

The IAM simulator evaluates matching policies for a principal, action, resource, and context.

In this incident

The same request changes from implicitDeny to allowed after the policy update.

Why it matters

It gives fast evidence, though a real job retry remains the final application check.