Ssm Parameter Encryption Remediation

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration "SSM Parameters Should Be Encrypted" in AWS using the AWS console, you can follow the below steps:

1. Open the AWS Management Console and navigate to the AWS Systems Manager console.
2. Click on the "Parameter Store" option in the left-hand navigation menu.
3. Select the parameter you want to encrypt and click on its name.
4. Click on the "Edit" button at the top of the page.
5. Check the "SecureString" option to encrypt the parameter.
6. Click on the "Save changes" button.

After completing these steps, the selected parameter will be encrypted. You can repeat these steps for any other parameters that need to be encrypted.

Using CLI

To remediate the misconfiguration of SSM parameters not being encrypted in AWS using AWS CLI, follow these steps:

1. Open the AWS CLI on your local machine.

2. Check if the SSM parameters are encrypted or not using the following command:

aws ssm get-parameters --names "parameter-name" --with-decryption

Replace "parameter-name" with the name of the SSM parameter you want to check.

3. If the SSM parameter is not encrypted, encrypt it using the following command:

aws ssm put-parameter --name "parameter-name" --value "parameter-value" --type "SecureString" --key-id "alias/aws/ssm" --overwrite

Replace "parameter-name" with the name of the SSM parameter you want to encrypt, "parameter-value" with the value of the parameter, and "--key-id" with the KMS key ID to use for encryption. In this case, we are using the default AWS SSM KMS key.

4. Verify that the SSM parameter is now encrypted by running the "get-parameters" command again with the "--with-decryption" flag.

aws ssm get-parameters --names "parameter-name" --with-decryption

This should return the value of the encrypted SSM parameter.

5. Repeat steps 2-4 for all SSM parameters that are not encrypted.

By following these steps, you can remediate the misconfiguration of SSM parameters not being encrypted in AWS using AWS CLI.

Using Python

To remediate the misconfiguration of SSM Parameters not being encrypted in AWS, you can follow these steps using Python:

1. Install the AWS SDK for Python (Boto3) using pip.

pip install boto3

2. Create an AWS session using the AWS access key and secret access key.

import boto3

session = boto3.Session(
    aws_access_key_id='YOUR_ACCESS_KEY',
    aws_secret_access_key='YOUR_SECRET_KEY'
)

3. Create a boto3 client for the SSM service.

ssm_client = session.client('ssm')

4. Use the describe_parameters() method to get a list of all the SSM parameters in the AWS account.

parameters = ssm_client.describe_parameters()

5. Loop through the list of parameters and check if the KeyId attribute is present. If it is not present, it means that the parameter is not encrypted.

for parameter in parameters['Parameters']:
    if 'KeyId' not in parameter:
        # Parameter is not encrypted

6. Use the update_parameter() method to encrypt the parameter. Set the KeyId parameter to the ARN of the KMS key to be used for encryption.

ssm_client.update_parameter(
    Name='PARAMETER_NAME',
    KeyId='KMS_KEY_ARN',
    Overwrite=True
)

7. Repeat steps 5 and 6 for all the SSM parameters that are not encrypted.

By following these steps, you can remediate the misconfiguration of SSM parameters not being encrypted in AWS using Python.

Using Terraform

resource "aws_ssm_parameter" "SENSITIVE_PARAMETER" {
  name  = "/PATH/TO/PARAMETER_NAME" # replace with the existing parameter name
  type  = "SecureString"
  value = "SENSITIVE_VALUE_HERE"    # replace with the current parameter value

  # Optional: use a customer-managed KMS key instead of the default SSM key
  # key_id = "arn:aws:kms:REGION:ACCOUNT_ID:key/KMS_KEY_ID_OR_ALIAS"
}

Changing an existing unencrypted aws_ssm_parameter from type = "String" (or StringList) to type = "SecureString" forces Terraform to delete and recreate the parameter with the same name, matching the CLI procedure; this delete/recreate can break applications during apply and the delete is irreversible, so run during a maintenance window.

For verification, terraform plan should show the existing aws_ssm_parameter being replaced (-/+) where the new resource has type = "SecureString" (and key_id if you configure a customer-managed key).