auditing-kms-key-policy-and-envelope-encryptionlisted

# Auditing KMS key policy and envelope encryption: who can actually decrypt Envelope encryption protects data with a data key and protects the data key with a managed master key, so the real access boundary is the master key's policy plus whatever encryption context constrains the data key. That indirection hides over-broad access. A key policy or grant can admit a principal who should never decrypt this data; a wildcard key resource in an identity policy can cover keys the author never considered; and an encryption context, meant to bind a data key to a specific scope, does nothing if the decrypt path does not enforce it. Cross-account grants widen the set further. The payload can be perfectly encrypted while the decrypt set quietly includes the wrong principals. You audit these by computing who can decrypt and comparing that to who should read the data. ## When to use - Data is protected by a managed key through envelope encryption, with a data key under a master key. - Decrypt access is governed by a key policy, key grants, and identity policies that may use wildcards. - An encryption context is used to scope a data key, and you need to confirm it is enforced on decrypt. ## Scope check Audit key access only in accounts and key stores you own or are authorized to assess. Confirming a decrypt recovers real plaintext, so stay inside the authorized keys and treat recovered data as sensitive within scope, never exfiltrating it. If you can't name the authorization, stop. #