Add policy for AWS KMS Key Confused Deputy Protection

[bcpenta]

Background

This policy ensures that AWS KMS Key policies with service principals include conditions to prevent cross-service confused deputy issues. Without these conditions (such as aws:SourceArn, aws:SourceAccount, aws:SourceOrgID, or aws:SourceOrgPaths), attackers may exploit the policy to misuse KMS keys by impersonating trusted services.
https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html

Changes

Added a new policy: AWS.KMS.ConfusedDeputyProtection to verify that AWS KMS Key policies containing service principals include at least one of the required conditions to prevent cross-service abuse.

Testing

KMS Key Policy Without Required Conditions:

A key policy with a service principal but no required conditions.
Expected Result: Fail.

KMS Key Policy With Required Conditions:

A key policy with a service principal and at least one valid condition.
Expected Result: Pass.

KMS Key Policy Without Service Principal:

A key policy without any service principal.
Expected Result: Pass.