Skip to main content

Existence Of Specific AWS KMS CMKs

More Info:​

Ensure that a specific list of AWS KMS Customer Master Keys (CMKs) are available for use in your AWS account in order to meet strict security and compliance requirements in your organization.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

The misconfiguration of "Existence of specific AWS KMS CMKs" means that there are AWS KMS Customer Master Keys (CMKs) that should not exist in your AWS account. To remediate this issue, follow the below steps:

  1. Login to your AWS Management Console.
  2. Go to the AWS KMS console.
  3. Click on "Customer managed keys" in the left-hand navigation menu.
  4. Identify the CMKs that should not exist in your account.
  5. Select the CMKs that should not exist in your account.
  6. Click on the "Schedule key deletion" button.
  7. In the "Schedule key deletion" dialog box, specify the number of days after which the key will be deleted.
  8. Click on the "Schedule deletion" button.

Once the keys are scheduled for deletion, you can monitor the progress of the deletion process in the AWS KMS console. It is recommended to delete the CMKs that are no longer required to avoid any potential security risks.

Using CLI

The following steps can be taken to remediate the "Existence Of Specific AWS KMS CMKs" misconfiguration for AWS using AWS CLI:

  1. Identify the specific AWS KMS CMKs that should not exist in your account.
  2. Use the AWS CLI command aws kms list-keys to list all the AWS KMS CMKs in your account.
  3. Review the list of AWS KMS CMKs returned by the command and identify any that should not exist.
  4. Use the AWS CLI command aws kms schedule-key-deletion to schedule the deletion of any unwanted AWS KMS CMKs. The command requires the ARN of the AWS KMS CMK to be deleted and the number of days until the key is permanently deleted. For example, the command to schedule the deletion of an AWS KMS CMK with the ARN arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab in 30 days would be:
aws kms schedule-key-deletion --key-id arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab --pending-window-in-days 30
  1. Repeat steps 4 and 5 for any other unwanted AWS KMS CMKs.

Note: Before deleting any AWS KMS CMKs, ensure that they are not being used by any resources in your account. Otherwise, deleting the key may cause those resources to stop functioning.

Using Python

The misconfiguration of "Existence Of Specific AWS KMS CMKs" means that certain AWS KMS Customer Master Keys (CMKs) that are required for encryption or decryption of data are missing. To remediate this issue in AWS using python, follow the below steps:

  1. Identify the missing AWS KMS CMKs that are required for encryption or decryption of data. This can be done by checking the logs or by analyzing the code.

  2. Create the missing AWS KMS CMKs using the AWS KMS console or AWS CLI. You can use the following AWS CLI command to create a CMK:

aws kms create-key --description "My CMK" --key-usage ENCRYPT_DECRYPT
  1. Once the CMKs are created, grant the necessary permissions to the AWS services or IAM users that require access to the CMKs. This can be done using the AWS KMS console or AWS CLI. You can use the following AWS CLI command to grant permissions to an IAM user:
aws kms create-grant --key-id <key-id> --grantee-principal <IAM-user-ARN> --operations Encrypt Decrypt

  1. Update the code or configuration to use the newly created AWS KMS CMKs for encryption or decryption of data.

  2. Test the updated code or configuration to ensure that the data is encrypted or decrypted correctly using the new AWS KMS CMKs.

  3. Finally, monitor the logs and alerts to ensure that the issue does not occur again in the future.

Using Terraform
resource "aws_kms_key" "REQUIRED_CMK" {
  # Replace REQUIRED_CMK with the identifier your organization expects
  description             = "Required CMK for APPLICATION_OR_COMPLIANCE_PURPOSE"
  key_usage               = "ENCRYPT_DECRYPT"
  customer_master_key_spec = "SYMMETRIC_DEFAULT"

  # Ensure the key is available for use (equivalent to `aws kms enable-key`)
  is_enabled = true

  # Set other properties according to your org requirements
  deletion_window_in_days = 30
}

resource "aws_kms_alias" "REQUIRED_CMK_ALIAS" {
  # Replace alias/required-key with the organization-mandated alias
  name          = "alias/REQUIRED_KEY_ALIAS"
  target_key_id = aws_kms_key.REQUIRED_CMK.key_id
}
  • Enabling a disabled KMS key in Terraform is done by setting is_enabled = true on aws_kms_key, which is an in-place update (no replacement).
  • Terraform cannot cancel a scheduled key deletion (aws kms cancel-key-deletion); that operation is not exposed by the provider and must be done via CLI or Console if a key is already in PendingDeletion.
  • After updating, terraform plan should show either creation of the required aws_kms_key/aws_kms_alias or an in-place change from is_enabled = false to is_enabled = true on an existing key, with no resource replacement.

Additional Reading:​