Quantum-resistant signing on AWS, Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM

This article explains how to enforce cryptographic algorithm policies on AWS by preventing unapproved ML-DSA parameter sets (like ML-DSA-44) while keeping approved variants (ML-DSA-65 and ML-DSA-87) fully usable.

• Use kms:KeySpec condition key in SCPs and IAM policies to block ML-DSA-44 key creation and usage across CreateKey, Sign, Verify, and GetPublicKey operations
• Apply SCPs at organization root or OUs for non-overridable preventive controls; use IAM policies and permission boundaries for per-account or per-role flexibility
• Restrict AWS Private CA creation to trusted roles and pin approved algorithms in provisioning pipelines, since no algorithm condition key exists for CreateCertificateAuthority
• Control certificate import and upload through process controls; deny iam:UploadServerCertificate where not required
• Use CloudTrail and AWS Config for detective controls to catch drift from approved algorithm policies
• Treat controls as defense-in-depth template adaptable to evolving cryptographic standards and organizational policies

These controls enable organizations to express and enforce cryptographic algorithm policies consistently across AWS services while maintaining flexibility as standards and requirements change.