Migrate to using mdbook

src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence.md

@@ -0,0 +1,39 @@
+# AWS - KMS Persistence
+
+{{#include ../../../banners/hacktricks-training.md}}
+
+## KMS
+
+For mor information check:
+
+{{#ref}}
+../aws-services/aws-kms-enum.md
+{{#endref}}
+
+### Grant acces via KMS policies
+
+An attacker could use the permission **`kms:PutKeyPolicy`** to **give access** to a key to a user under his control or even to an external account. Check the [**KMS Privesc page**](../aws-privilege-escalation/aws-kms-privesc.md) for more information.
+
+### Eternal Grant
+
+Grants are another way to give a principal some permissions over a specific key. It's possible to give a grant that allows a user to create grants. Moreover, a user can have several grant (even identical) over the same key.
+
+Therefore, it's possible for a user to have 10 grants with all the permissions. The attacker should monitor this constantly. And if at some point 1 grant is removed another 10 should be generated.
+
+(We are using 10 and not 2 to be able to detect that a grant was removed while the user still has some grant)
+
+```bash
+# To generate grants, generate 10 like this one
+aws kms create-grant \
+    --key-id <key-id> \
+    --grantee-principal <user_arn> \
+    --operations "CreateGrant" "Decrypt"
+
+# To monitor grants
+aws kms list-grants --key-id <key-id>
+```
+
+> [!NOTE]
+> A grant can give permissions only from this: [https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations)
+
+{{#include ../../../banners/hacktricks-training.md}}