> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kms db tier remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        The remediation steps for "Database-tier KMS Key Should Be In Use" in AWS using the AWS console are as follows:

        1. Open the Amazon RDS console at [https://console.aws.amazon.com/rds/](https://console.aws.amazon.com/rds/).
        2. In the navigation pane, choose "Encryption".
        3. Select the DB instance that you want to encrypt.
        4. Click on the "Modify" button.
        5. In the "Encryption" section, choose "Yes" for the "Encrypt this DB instance" option.
        6. Select the KMS key that you want to use for encryption in the "KMS key ID" drop-down list.
        7. Click on the "Continue" button.
        8. Review the changes and click on the "Modify DB instance" button to apply the changes.

        After completing these steps, the database-tier KMS key will be in use, and the misconfiguration will be remediated.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Database-tier KMS Key Should Be In Use" misconfiguration in AWS using AWS CLI, follow these steps:

        1. Open the AWS CLI on your local machine.

        2. Run the following command to list all the RDS instances in your AWS account:

        ```
        aws rds describe-db-instances
        ```

        3. Identify the RDS instance that has the misconfiguration.

        4. Run the following command to modify the RDS instance to use a KMS key:

        ```
        aws rds modify-db-instance --db-instance-identifier <your-db-instance-identifier> --kms-key-id <your-kms-key-id>
        ```

        Replace `<your-db-instance-identifier>` with the name of your RDS instance and `<your-kms-key-id>` with the ID of the KMS key that you want to use.

        5. Verify that the RDS instance is now using the KMS key by running the following command:

        ```
        aws rds describe-db-instances --db-instance-identifier <your-db-instance-identifier> | grep KmsKeyId
        ```

        This command should return the ID of the KMS key that you specified in step 4.

        6. Repeat steps 4 and 5 for all the RDS instances that have the misconfiguration.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Database-tier KMS Key Should Be In Use" misconfiguration in AWS using Python, you can follow these steps:

        1. Identify the RDS instances that are not using a KMS key for encryption.

        2. Use the AWS SDK for Python (Boto3) to modify the RDS instances to use a KMS key for encryption.

        Here is the Python code to accomplish this:

        ```python theme={null}
        import boto3

        # Create an RDS client
        rds = boto3.client('rds')

        # Get a list of all RDS instances
        instances = rds.describe_db_instances()

        # Loop through each instance and check if it is using a KMS key for encryption
        for instance in instances['DBInstances']:
            if 'KmsKeyId' not in instance:
                # If the instance is not using a KMS key, modify it to use one
                rds.modify_db_instance(
                    DBInstanceIdentifier=instance['DBInstanceIdentifier'],
                    KmsKeyId='your_kms_key_id_here'
                )
        ```

        Replace "your\_kms\_key\_id\_here" with the ID of the KMS key that you want to use for encryption.

        This code will loop through all RDS instances and modify any instances that are not using a KMS key for encryption to use the specified KMS key.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_kms_key" "database_tier" {
          description             = "KMS key for database tier encryption"
          deletion_window_in_days = 30
          enable_key_rotation     = true

          tags = {
            Tier = "Database" # Required: identifies this KMS key as the database-tier key
          }

          # OPTIONAL BUT RECOMMENDED: Replace THIS with a least-privilege policy
          # that grants necessary IAM users/roles/services access to use the key.
          # key_policy = jsonencode({
          #   Version = "2012-10-17"
          #   Statement = [
          #     {
          #       Sid       = "EnableRootAccount"
          #       Effect    = "Allow"
          #       Principal = { AWS = "arn:aws:iam::${DATA_ACCOUNT_ID}:root" }
          #       Action    = "kms:*"
          #       Resource  = "*"
          #     }
          #   ]
          # })
        }
        ```

        Substitute `DATA_ACCOUNT_ID` with your AWS account ID if you implement the optional `key_policy`.

        This change only creates a new KMS key; it does not force replacement of existing resources. You must separately update your database services (RDS, DynamoDB, Redshift, etc.) to use `aws_kms_key.database_tier.arn` for encryption at rest.

        Verification: `terraform plan` should show one new resource to add: `aws_kms_key.database_tier` (no changes or destroys).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>