Skip to main content

aws_kms_keys Resource

Use the aws_kms_keys InSpec audit resource to test properties of some or all AWS KMS Keys.

AWS Key Management Service (KMS) is a managed service that makes creating and controlling your encryption keys for your data easier. KMS uses Hardware Security Modules (HSMs) to protect the security of your keys.

AWS Key Management Service is integrated with several other AWS services to help you protect the data you store with these services.

For additional information, including details on parameters and properties, see the AWS documentation on KS Keys.


This resource is available in the Chef InSpec AWS resource pack.

For information on configuring your AWS environment for Chef InSpec and creating an InSpec profile that uses the InSpec AWS resource pack, see the Chef InSpec documentation on the AWS cloud platform.


An aws_kms_keys resource block uses an optional filter to select a group of KMS Keys and then tests that group.

# Verify the number of KMS keys in the AWS account
describe aws_kms_keys do
  its('entries.count') { should cmp 10 }


This resource does not require any parameters.


The IDs of the returned keys.
The Amazon Resource Names of the returned keys.
Provides access to the raw results of the query, which can be treated as an array of hashes.


The following examples show how to use this InSpec audit resource.

Ensure a Key exists.

describe aws_kms_keys do
  its('key_ids') { should include 'fd7e608b-f435-4186-b8b5-111111111111'}

Allow at most 100 KMS Keys on the account.

describe aws_kms_keys do
  its('entries.count') { should be <= 100}


For a full list of available matchers, see our Universal Matchers page.

This resource has the following special matchers.


The control will pass if the describe returns at least one result.

Use should_not to test the entity should not exist.

describe aws_kms_keys do
  it { should exist }
describe aws_kms_keys.where( <property>: <value>) do
  it { should_not exist }

AWS Permissions

Your Principal will need the KMS:Client:ListKeysResponse action with Effect set to Allow.

You can find detailed documentation at Actions, Resources, and Condition Keys for AWS Key Management Service.

Edit this page on GitHub

Thank you for your feedback!


Search Results