enforce mfa for admin role, restrict calleraccount
"kms:ScheduleKeyDeletion",
"kms:CancelKeyDeletion"
],
- "Resource": "*"
+ "Resource": "*",
+ "Condition": {
+ "NumericLessThan": {
+ "aws:MultiFactorAuthAge": "300"
+ }
+ }
},
{
"Sid": "Allow use of the key",
".amazonaws.com"
]
]
+ },
+ "kms:CallerAccount": {
+ "Ref": "AWS::AccountId"
}
}
}
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": true
+ },
+ "StringEquals": {
+ "kms:CallerAccount": {
+ "Ref": "AWS::AccountId"
+ }
}
}
},
]
]
}
+ },
+ "kms:CallerAccount": {
+ "Ref": "AWS::AccountId"
}
}
},
".amazonaws.com"
]
]
+ },
+ "kms:CallerAccount": {
+ "Ref": "AWS::AccountId"
}
}
}
