Ensure Kubernetes Secrets Are Encrypted Using CMKs Managed In AWS KMS

#!/usr/bin/env bash
#
# Report whether EKS clusters have Kubernetes Secrets encrypted with a
# customer-managed AWS KMS key (CMK).
#
# REQUIREMENTS:
#   - AWS CLI v2 configured with sufficient permissions
#   - jq
#
# SCOPE:
#   - This runs from any machine with AWS CLI access.
#   - It inspects all EKS clusters in the specified region(s).

set -euo pipefail

REGIONS="${*:-}"

if [ -z "$REGIONS" ]; then
  echo "Usage: $0 <region-1> [region-2] ..."
  echo "Example: $0 us-east-1 us-west-2"
  exit 1
fi

for REGION in $REGIONS; do
  echo "=== Region: $REGION ==="
  CLUSTERS=$(aws eks list-clusters --region "$REGION" --output json | jq -r '.clusters[]?')

  if [ -z "$CLUSTERS" ]; then
    echo "  No EKS clusters found."
    continue
  fi

  for CLUSTER in $CLUSTERS; do
    echo "  Cluster: $CLUSTER"

    DESC=$(aws eks describe-cluster --region "$REGION" --name "$CLUSTER" --output json)

    # Extract encryption config for secrets provider
    ENC_CFG=$(echo "$DESC" | jq -c '.cluster.encryptionConfig[]? | select(.resources[]? == "secrets")')

    if [ -z "$ENC_CFG" ]; then
      echo "    status: NON-COMPLIANT - no encryptionConfig for secrets (no KMS envelope encryption)."
      continue
    fi

    # There may be multiple keyArn entries; report them all
    KEY_ARNS=$(echo "$ENC_CFG" | jq -r '.provider.keyArn // empty')

    if [ -z "$KEY_ARNS" ]; then
      echo "    status: NON-COMPLIANT - secrets encryptionConfig present but no KMS keyArn found."
      continue
    fi

    # For each key, determine whether it is customer-managed or AWS-managed
    while IFS= read -r KEY_ARN; do
      if [ -z "$KEY_ARN" ]; then
        continue
      fi

      # Describe the KMS key
      KEY_DESC=$(aws kms describe-key --region "$REGION" --key-id "$KEY_ARN" --output json 2>/dev/null || true)

      if [ -z "$KEY_DESC" ]; then
        echo "    status: REVIEW - KMS key $KEY_ARN not describable (check permissions/existence)."
        continue
      fi

      KEY_MANAGER=$(echo "$KEY_DESC" | jq -r '.KeyMetadata.KeyManager')
      KEY_STATE=$(echo "$KEY_DESC"   | jq -r '.KeyMetadata.KeyState')
      KEY_USAGE=$(echo "$KEY_DESC"   | jq -r '.KeyMetadata.KeyUsage')

      # KeyManager:
      #   - 'CUSTOMER' => customer-managed CMK (desired)
      #   - 'AWS'      => AWS-managed key (not compliant with CMK requirement)
      if [ "$KEY_MANAGER" = "CUSTOMER" ] && [ "$KEY_STATE" = "Enabled" ] && [ "$KEY_USAGE" = "ENCRYPT_DECRYPT" ]; then
        echo "    status: COMPLIANT - secrets encrypted with CUSTOMER-managed CMK:"
        echo "      keyArn:    $KEY_ARN"
        echo "      keyState:  $KEY_STATE"
        echo "      keyUsage:  $KEY_USAGE"
      else
        echo "    status: NON-COMPLIANT - secrets encryption uses non-CUSTOMER CMK or unusable key:"
        echo "      keyArn:    $KEY_ARN"
        echo "      keyManager:$KEY_MANAGER (expected: CUSTOMER)"
        echo "      keyState:  $KEY_STATE (expected: Enabled)"
        echo "      keyUsage:  $KEY_USAGE (expected: ENCRYPT_DECRYPT)"
      fi

    done <<< "$KEY_ARNS"

  done
done