> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Secret encrypted kms cmk remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Here are the step-by-step instructions to remediate the "Secret Manager Secrets Should Be Encrypted With CMKs" misconfiguration in AWS using the AWS console:

        1. Log in to the AWS Management Console and navigate to the AWS Secrets Manager service.

        2. Click on the secret that needs to be remediated.

        3. Under the "Encryption" section, click on the "Edit" button.

        4. Select the "AWS KMS customer master key (CMK)" option.

        5. Choose the appropriate CMK from the list or create a new one.

        6. Click on the "Save" button to save the changes.

        7. Ensure that the secret is now encrypted with the selected CMK by checking the "Encryption" section.

        That's it! Following these steps should remediate the "Secret Manager Secrets Should Be Encrypted With CMKs" misconfiguration in AWS.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Secret Manager Secrets Should Be Encrypted With CMKs" for AWS using AWS CLI, you can follow the below steps:

        1. Open the AWS CLI on your local machine or EC2 instance.

        2. Run the following command to list all the secrets in the Secret Manager:

           ```
           aws secretsmanager list-secrets
           ```

        3. Note down the ARN of the secret that needs to be encrypted with a CMK.

        4. Create a new KMS customer managed key (CMK) by running the following command:

           ```
           aws kms create-key --description "My new CMK"
           ```

        5. Note down the ARN of the newly created CMK.

        6. Run the following command to update the secret to use the newly created CMK:

           ```
           aws secretsmanager update-secret-version-stage --secret-id <ARN-of-secret> --secret-version-stage AWSCURRENT --kms-key-id <ARN-of-new-CMK>
           ```

           Replace `<ARN-of-secret>` with the ARN of the secret that needs to be encrypted with a CMK, and `<ARN-of-new-CMK>` with the ARN of the newly created CMK.

        7. Verify that the secret is now encrypted with the new CMK by running the following command:

           ```
           aws secretsmanager describe-secret --secret-id <ARN-of-secret>
           ```

           This command should return the details of the secret, including the KMS key ID.

        By following the above steps, you can remediate the misconfiguration "Secret Manager Secrets Should Be Encrypted With CMKs" for AWS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Secret Manager Secrets Should Be Encrypted With CMKs" in AWS using Python, you can follow the below steps:

        1. Create a Customer Managed Key (CMK) in AWS Key Management Service (KMS) if not already created.

        ```python theme={null}
        import boto3

        kms_client = boto3.client('kms')

        response = kms_client.create_key(
            Description='CMK for Secret Manager',
            KeyUsage='ENCRYPT_DECRYPT',
            Origin='AWS_KMS'
        )

        cmk_arn = response['KeyMetadata']['Arn']
        ```

        2. Enable Key Rotation for the CMK created in step 1.

        ```python theme={null}
        import boto3

        kms_client = boto3.client('kms')

        kms_client.enable_key_rotation(
            KeyId='CMK_ARN'
        )
        ```

        3. Update the Secrets in AWS Secret Manager to use the CMK created in step 1 for encryption.

        ```python theme={null}
        import boto3

        secrets_client = boto3.client('secretsmanager')

        response = secrets_client.update_secret(
            SecretId='SECRET_NAME',
            KmsKeyId='CMK_ARN',
            SecretString='{"username":"admin","password":"secret"}'
        )
        ```

        Note: Replace `CMK_ARN` with the ARN of the CMK created in step 1 and `SECRET_NAME` with the name of the Secret in AWS Secret Manager that needs to be updated.

        By following these steps, you can remediate the misconfiguration "Secret Manager Secrets Should Be Encrypted With CMKs" for AWS using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_secretsmanager_secret" "new_cmk_encrypted_secret" {
          # Replace with a unique name for the new secret
          name = "NEW_SECRET_NAME_FOR_ASSET_LABEL"

          # Replace with the ARN of your customer-managed KMS key
          kms_key_id = "KMS_CMK_KEY_ARN"

          description              = "CMK-encrypted replacement for OLD_SECRET_NAME"
          recovery_window_in_days  = 7
        }
        ```

        Substitute:

        * `NEW_SECRET_NAME_FOR_ASSET_LABEL` with the new secret name you want.
        * `KMS_CMK_KEY_ARN` with the ARN of your customer-managed KMS key.

        You must separately supply the secret value (e.g., via `aws_secretsmanager_secret_version`, external data source, or a module variable) and update all applications to use the new secret’s ARN. The original secret must then be deleted/scheduled for deletion (you can import it as a separate `aws_secretsmanager_secret` resource and remove it from configuration to let Terraform call `DeleteSecret` with the configured `recovery_window_in_days`).

        Changing `kms_key_id` on an existing `aws_secretsmanager_secret` forces replacement, so `terraform plan` should show the old secret being destroyed and a new CMK-encrypted secret created (with a different ARN) or, if you model both, the old secret being scheduled for deletion and the new CMK-encrypted secret being created.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>