feat(iam): add new check iam_policy_no_kms_decryption_actions

[HugoPBrito]

Context

AWS Key Management Service (KMS) helps manage encryption keys to secure data across AWS. To protect sensitive data, IAM customer managed policies should avoid granting broad decryption permissions on all KMS keys, adhering to the principle of least privilege. This principle emphasizes granting users, roles, or groups only the specific permissions necessary to perform their tasks, minimizing the risk of unauthorized data access.

Description

This check assesses IAM customer managed policies to ensure they don’t allow kms:Decrypt or kms:ReEncryptFrom permissions across all KMS keys. If a policy is configured to allow these actions on all resources (indicated by a wildcard or similar pattern in the Resource element), the check fails. Broad permissions could expose encrypted data unnecessarily and elevate the risk of data misuse.

Checklist

• Are there new checks included in this PR? Yes.
  • If so, do we need to update permissions for the provider? No.
• Review if the code is being covered by tests.
• Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
• Review if backport is needed.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.78%. Comparing base (17dd9de) to head (2681acf).
Report is 3 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #5619   +/-   ##
=======================================
  Coverage   89.77%   89.78%           
=======================================
  Files        1104     1105    +1     
  Lines       34262    34285   +23     
=======================================
+ Hits        30760    30783   +23     
  Misses       3502     3502           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.