Description

Ensure access to the OVHcloud Key Management Service (KMS) is granted only through IAM policies that name specific users, groups, or service accounts, specific KMS resources, and only the actions they need, such as encrypt or decrypt.

Rationale

Encryption keys protect sensitive data, so anyone who can use or manage them can decrypt that data or destroy it. Broad KMS permissions put all encrypted data at risk if one account is compromised. Scoped policies limit each identity to the keys and actions it needs.

Impact

  • Limits who can use or manage encryption keys

  • Protects encrypted data from misuse

  • Applications may need new, narrower policies

Default Value

By default, only the account owner and identities granted by IAM policies can access KMS.

Pre-Requisites

  • Access to the OVHcloud account owner login or an IAM administrator

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Policies.

  4. Review policies whose product types include Key Management Service.

  5. Flag policies that grant all actions or cover all KMS resources without need.

  6. If any are found, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Policies.

  4. Edit the policy to name only the required identities, select only the specific KMS resources, and choose only the needed actions.

  5. Save the policy and confirm the applications still work.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Policies.

  4. Restore the previous policy settings and save.

Reference