KMS Customer Master Key Should Be In Use
More Info:
You should have KMS CMK customer-managed keys in use in your account instead of AWS managed-keys in order to have full control over your data encryption and decryption process.Risk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the KMS Customer Master Key Should Be In Use misconfiguration in AWS using AWS console, follow these steps:
- Open the AWS Management Console and navigate to the AWS Key Management Service (KMS) console.
- Click on the “Customer managed keys” option in the left-hand menu.
- Identify the key that is not in use and select it by clicking on its alias.
- Click on the “Key actions” dropdown menu and select “Enable Key”.
- In the pop-up window, select the AWS service(s) that you want to use the key with and click “Enable”.
- Once enabled, the key will be available for use by the selected AWS service(s).
- Repeat steps 3-6 for any other keys that are not in use.
- Verify that the KMS Customer Master Key is now in use by checking the compliance status of the resource or by running a compliance check.
Using CLI
Using CLI
The misconfiguration “KMS Customer Master Key Should Be In Use” suggests that the AWS Key Management Service (KMS) is not being used to encrypt data at rest. To remediate this, you can follow these steps using AWS CLI:Replace Note: Make sure to test the remediation steps in a non-production environment before applying them to a production environment.
- Identify the resources that are not using KMS encryption. You can use the following command to list all the EBS volumes that are not encrypted with KMS:
- Encrypt the EBS volumes with KMS. To do this, create a new KMS Customer Master Key (CMK) or use an existing one. You can use the following command to create a new CMK:
- Once you have a CMK, you can use it to encrypt the EBS volumes. You can use the following command to encrypt a specific EBS volume:
<volume-id> with the ID of the EBS volume and <kms-key-id> with the ID of the CMK.- Repeat step 3 for all the EBS volumes that are not encrypted with KMS.
- Finally, verify that all the EBS volumes are encrypted with KMS. You can use the following command to list all the EBS volumes and their encryption status:
Using Python
Using Python
To remediate the misconfiguration of KMS Customer Master Key Should Be In Use in AWS using Python, follow these steps:This code snippet updates the bucket policy to deny uploads of unencrypted objects and adds a condition to require the use of a KMS customer master key for server-side encryption of objects in the bucket.
-
Identify the AWS resource that is not using a KMS customer master key. This can be done by using the AWS CLI command
aws kms list-aliasesto list all the KMS customer master keys andaws kms list-grantsto list all the grants for the KMS customer master keys. - Once you have identified the resource that is not using a KMS customer master key, you can use the AWS SDK for Python (Boto3) to update the resource to use a KMS customer master key. For example, if the resource is an S3 bucket, you can use the following code snippet to update the bucket policy to use a KMS customer master key:
- Repeat the above steps for any other AWS resources that are not using a KMS customer master key.