Restricting decryption of SecureString parameter values
A SecureString parameter value is encrypted with an Amazon KMS key.
Any principal that retrieves the decrypted value must have
kms:Decrypt permission on that key, whichever Parameter Store operation
they call. This makes Amazon KMS key permissions an effective control for
SecureString parameters, because a single Amazon KMS policy
statement applies to all retrieval paths at once.
To use this control effectively, encrypt sensitive parameters with a customer managed key rather than the Amazon managed key.
Important
The Amazon managed key for Parameter Store
(aws/ssm) grants Decrypt permission to all
IAM principals in the Amazon Web Services account. If you need different levels of
access to SecureString parameters within an account, don't
encrypt them with the default key.
For key policy examples, including how to deny access to the Amazon managed key and how to grant access to a customer managed key, see Encrypting and decrypting parameters using Amazon KMS keys.
Note
Restricting kms:Decrypt prevents a principal from reading an
encrypted value. It doesn't hide the
parameter's name, description, or other metadata, which aren't encrypted,
and it doesn't prevent the parameter from being listed. Use Parameter Store action
denies as described in Restricting access to specific parameters and paths to control those.