> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kms app tier remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the "App-tier KMS Key Should Be In Use" misconfiguration in AWS using the AWS console:

        1. Open the AWS Management Console and navigate to the AWS KMS service.
        2. Click on "Customer managed keys" from the left-hand menu.
        3. Search for the KMS key that is used to encrypt data at the app-tier.
        4. Check if the key is enabled and has an alias name.
        5. If the key is disabled, enable it by selecting the key and clicking on "Enable key" from the "Actions" menu.
        6. If the key does not have an alias name, add an alias by selecting the key and clicking on "Add alias" from the "Actions" menu.
        7. Provide an alias name for the key and click on "Create alias".
        8. Now, navigate to the app-tier EC2 instance and stop the instance.
        9. Go to the EC2 instance details page and click on the "Volumes" tab.
        10. Select the root volume of the instance and click on "Actions" > "Create snapshot".
        11. Once the snapshot is created, click on "Actions" > "Create image".
        12. Provide a name and description for the image and select the KMS key that was enabled in step 5.
        13. Click on "Create image".
        14. Once the image is created, start a new EC2 instance from the image.
        15. Verify that the new instance is using the KMS key by checking the "Encryption" attribute of the root volume.

        By following these steps, you should be able to remediate the "App-tier KMS Key Should Be In Use" misconfiguration in AWS.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "App-tier KMS Key Should Be In Use" misconfiguration for AWS using AWS CLI, follow these steps:

        1. Log in to the AWS Management Console.

        2. Open the AWS CLI and run the following command to check if the KMS key is in use:

           ```
           aws kms list-aliases
           ```

           This command will list all the KMS keys available in your account.

        3. Identify the KMS key that should be used for the App-tier and note down its ARN.

        4. Open the AWS CLI and run the following command to update the App-tier to use the correct KMS key:

           ```
           aws elasticbeanstalk update-environment --environment-name <environment-name> --option-settings Namespace=aws:elasticbeanstalk:application:environment,OptionName=APP_TIER_KMS_KEY_ID,Value=<KMS-key-ARN>
           ```

           Replace `<environment-name>` with the name of the environment that needs to be updated, and `<KMS-key-ARN>` with the ARN of the correct KMS key.

        5. Verify that the update was successful by running the following command:

           ```
           aws elasticbeanstalk describe-environments --environment-names <environment-name>
           ```

           This command will return the details of the environment. Check that the `APP_TIER_KMS_KEY_ID` option is set to the correct KMS key ARN.

        6. Repeat the above steps for all environments in your AWS account that are affected by this misconfiguration.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "App-tier KMS Key Should Be In Use" misconfiguration in AWS using Python, you can follow these steps:

        1. First, you need to identify the App-tier KMS Key that should be used. You can do this by checking your AWS account to see if there is a KMS Key that is specifically designated for use with your App-tier resources. If there is, note down the ARN of the KMS Key.

        2. Next, you need to update your App-tier resources to use the designated KMS Key. You can do this by using the AWS SDK for Python (Boto3) to modify the resources' encryption settings. Here's an example code snippet that shows how to do this for an EC2 instance:

        ```python theme={null}
        import boto3

        # Replace the values in the following variables with your own values
        instance_id = 'your-instance-id'
        kms_key_arn = 'your-kms-key-arn'

        # Create a Boto3 EC2 client
        ec2 = boto3.client('ec2')

        # Modify the instance's encryption settings to use the designated KMS Key
        response = ec2.modify_instance_attribute(
            InstanceId=instance_id,
            BlockDeviceMappings=[
                {
                    'DeviceName': '/dev/sda1',
                    'Ebs': {
                        'Encrypted': True,
                        'KmsKeyId': kms_key_arn
                    }
                }
            ]
        )
        ```

        This code modifies the encryption settings of the root EBS volume of an EC2 instance to use the designated KMS Key.

        3. Finally, you should verify that the App-tier resources are now using the designated KMS Key. You can do this by checking the encryption settings of the resources using the AWS Management Console or the AWS CLI.

        By following these steps, you should be able to remediate the "App-tier KMS Key Should Be In Use" misconfiguration in AWS using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_kms_key" "app_tier" {
          description             = "KMS key for application tier data encryption"
          enable_key_rotation     = true
          deletion_window_in_days = 30

          tags = {
            Purpose = "AppTier" # adjust to your org's tagging standards
          }
        }

        resource "aws_kms_alias" "app_tier" {
          name          = "alias/app-tier-key" # adjust to your org's alias standard
          target_key_id = aws_kms_key.app_tier.key_id
        }
        ```

        This creates a new symmetric KMS key for the application tier, tags it with `Purpose=AppTier`, and assigns the alias `alias/app-tier-key`; it will incur ongoing KMS costs.

        `terraform plan` should show one new `aws_kms_key` and one new `aws_kms_alias` being created, with no other changes.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>