[NathanWilliams]

Noticed something odd today I think is connected to this.

The other day we started using Access Advisor, and we found some of our KMS key policies with a Principal of '*'.

It wasn't marked as globally open, so we planned to fix them a little later.

This morning we found that status had changed.

While we were in the wrong to begin with, it was a little surprising to find the interpretation of the key policy changing overnight.

Of course it became our top priority and is now fixed. Something to look out for...