title: AWS Unauthorised Operation AWSServiceRoleForConfig on KMS Key Decrypt
body: <p>Every day I'm seeing some CloudTrail logs for unauthorised KMS decrypt operations and I'm can't figure out what's causing it. Here is an example of the logs:</p>
  <pre><code>{
      &quot;eventVersion&quot;: &quot;1.08&quot;,
      &quot;userIdentity&quot;: {
          &quot;type&quot;: &quot;AssumedRole&quot;,
          &quot;principalId&quot;: &quot;*********************:LambdaDescribeHandlerSession&quot;,
          &quot;arn&quot;: &quot;arn:aws:sts::************:assumed-role/AWSServiceRoleForConfig/LambdaDescribeHandlerSession&quot;,
          &quot;accountId&quot;: &quot;************&quot;,
          &quot;accessKeyId&quot;: &quot;********************&quot;,
          &quot;sessionContext&quot;: {
              &quot;sessionIssuer&quot;: {
                  &quot;type&quot;: &quot;Role&quot;,
                  &quot;principalId&quot;: &quot;&quot;********************&quot;,
                  &quot;arn&quot;: &quot;arn:aws:iam::************:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig&quot;,
                  &quot;accountId&quot;: &quot;************&quot;,
                  &quot;userName&quot;: &quot;AWSServiceRoleForConfig&quot;
              },
              &quot;webIdFederationData&quot;: {},
              &quot;attributes&quot;: {
                  &quot;creationDate&quot;: &quot;2021-11-28T12:53:33Z&quot;,
                  &quot;mfaAuthenticated&quot;: &quot;false&quot;
              }
          },
          &quot;invokedBy&quot;: &quot;config.amazonaws.com&quot;
      },
      &quot;eventTime&quot;: &quot;2021-11-28T12:53:33Z&quot;,
      &quot;eventSource&quot;: &quot;kms.amazonaws.com&quot;,
      &quot;eventName&quot;: &quot;Decrypt&quot;,
      &quot;awsRegion&quot;: &quot;eu-west-1&quot;,
      &quot;sourceIPAddress&quot;: &quot;config.amazonaws.com&quot;,
      &quot;userAgent&quot;: &quot;config.amazonaws.com&quot;,
      &quot;errorCode&quot;: &quot;AccessDenied&quot;,
      &quot;errorMessage&quot;: &quot;User: arn:aws:sts::************:assumed-role/AWSServiceRoleForConfig/LambdaDescribeHandlerSession is not authorized to perform: kms:Decrypt on resource: arn:aws:kms:eu-west-1:************:key/********-****-****-****-************ because no resource-based policy allows the kms:Decrypt action&quot;,
      &quot;requestParameters&quot;: null,
      &quot;responseElements&quot;: null,
      &quot;requestID&quot;: &quot;7bb5bcac-29ab-4d03-b2b9-fc9d7125286e&quot;,
      &quot;eventID&quot;: &quot;5308c08c-2f09-4fbe-bd10-32e7aa9ee43c&quot;,
      &quot;readOnly&quot;: true,
      &quot;eventType&quot;: &quot;AwsApiCall&quot;,
      &quot;managementEvent&quot;: true,
      &quot;recipientAccountId&quot;: &quot;************&quot;,
      &quot;eventCategory&quot;: &quot;Management&quot;
  }
  </code></pre>
  <p>I've attempted update the KMS policy with the following which doesn't seem to have helped:</p>
  <pre><code>        {
              &quot;Sid&quot;: &quot;Grant AWS Config Decrypt Access To Avoid Unauthorised Errors&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: {
                  &quot;Service&quot;: &quot;config.amazonaws.com&quot;
              },
              &quot;Action&quot;: &quot;kms:Decrypt&quot;,
              &quot;Resource&quot;: &quot;*&quot;
          }
  </code></pre>
  <p>I've checked the IAM role <code>arn:aws:iam::************:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig</code> and I can see that this does not allow the <code>kms:Decrypt</code> action. However, this is a managed role from AWS and I am unable to update that policy.</p>
  <p>Is this an issue that AWS need to resolve? Is it possible to switch Config to using a custom role with the <code>kms:Decrypt</code> action allowed? Is that even worth it or will it just cause more problems in the future when AWS update the managed role and I haven't added something to the custom role?</p>