Restricting decryption of SecureString parameter values

A SecureString parameter value is encrypted with an AWS KMS key. Any principal that retrieves the decrypted value must have kms:Decrypt permission on that key, whichever Parameter Store operation they call. This makes AWS KMS key permissions an effective control for SecureString parameters, because a single AWS KMS policy statement applies to all retrieval paths at once.

To use this control effectively, encrypt sensitive parameters with a customer managed key rather than the AWS managed key.

Important

The AWS managed key for Parameter Store (aws/ssm) grants Decrypt permission to all IAM principals in the AWS account. If you need different levels of access to SecureString parameters within an account, don't encrypt them with the default key.

For key policy examples, including how to deny access to the AWS managed key and how to grant access to a customer managed key, see Encrypting and decrypting parameters using AWS KMS keys.

Note

Restricting kms:Decrypt prevents a principal from reading an encrypted value. It doesn't hide the parameter's name, description, or other metadata, which aren't encrypted, and it doesn't prevent the parameter from being listed. Use Parameter Store action denies as described in Restricting access to specific parameters and paths to control those.