Misconfigured permissions that allow broad invocation of the Decrypt API can expose plaintext data, enabling unintended disclosure or exfiltration of sensitive information.
A KMS Key is Used to Decrypt Data Without Restriction
CCC.KeyMgmt.TH02
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CP10 | Decrypt Data | The service can decrypt ciphertext submitted by a user with a managed key and return the plaintext without exposing the key material. |
| CCC.KeyMgmt.CP17 | Enable Key | The service can re-enable a disabled managed key or key version so that cryptographic operations with it resume. |
| CCC.Core.CP06 | Access Control | The service automatically enforces user configurations to restrict or allow access to a specific component or a child resource based on factors such as user identities, roles, groups, or attributes. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.CN02 | Limit Cryptographic Operation Grants | Restrict the decrypt, sign, and MAC-generation operations to authorised principals only, applying the principle of least privilege to protect sensitive data and the integrity of signed content. |