KMS Policy Inspector

This tool analyzes AWS KMS key policies to determine Inspector compatibility and to uncover access-control gaps. It parses the policy JSON, normalizes statements, then applies risk rules to identify wildcard principals, missing Inspector actions, or overly broad permissions. The analysis yields a risk score, a list of issues with severity, and concrete remediation guidance. Conceptually, the tool treats the key policy as the authoritative access surface and evaluates whether Inspector can operate without granting excessive privileges. It supports practical use cases such as auditing keys used by Inspector during scans, verifying cross-account access restrictions, and ensuring least-privilege principals. Core features include policy parsing, action coverage checks for kms:Decrypt, kms:DescribeKey, kms:Encrypt, and related operations, detection of wildcard principals on sensitive actions, condition-based access validation, and exportable remediation recommendations. The tool is valuable for security engineers, cloud architects, and auditors who must demonstrate controlled access for Inspector workloads while maintaining encryption key safety. Outputs highlight high-risk statements, provide targeted fixes (e.g., tighten principals, add source restrictions, remove wildcards), and offer follow-up checks to validate after changes. It complements AWS IAM policy reviews by focusing on the KMS policy surface and Inspector-specific needs, enabling faster, repeatable security assessments across multiple AWS accounts and regions.