Should Use Customer-Managed Keys Instead Of AWS-managed Keys

More Info:

Your RDS database instances should be using KMS CMK customer-managed keys rather than AWS managed-keys in order to have more granular control over your data-at-rest encryption/decryption process.

Risk Level

Medium

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
AWS Startup Security Baseline
AWS Well Architected Framework
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
FedRAMP
GDPR
HITRUST CSF
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIST
NIST CSF
NIST SP 800-171
NYDFS 23 NYCRR 500
PCI
SOC2
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of using AWS-managed keys instead of Customer-Managed Keys for AWS RDS using the AWS console, follow these steps:

Create a Customer-Managed Key (CMK):
- Go to the AWS Key Management Service (KMS) console.
- Click on "Create key" to create a new CMK.
- Choose the key creation method (Symmetric key or Asymmetric key) based on your requirements.
- Define key administrative permissions and key usage permissions.
- Click on "Finish" to create the CMK.
Update the RDS Instance to use the Customer-Managed Key:
- Go to the Amazon RDS console.
- Select the RDS instance for which you want to update the encryption key.
- Click on "Modify" to modify the instance settings.
- In the "Encryption" section, choose the option to encrypt using a Customer-Managed Key.
- Select the Customer-Managed Key (CMK) that you created in step 1.
- Click on "Continue" and review the changes.
- Click on "Modify DB Instance" to apply the changes.
Monitor the Encryption Key Update:
- Once you have modified the RDS instance to use the Customer-Managed Key, monitor the instance to ensure that the encryption key update is successful.
- Check the RDS instance status and logs for any errors related to the encryption key update.
- Verify that the RDS instance is using the Customer-Managed Key for encryption.

By following these steps, you can remediate the misconfiguration of using AWS-managed keys instead of Customer-Managed Keys for AWS RDS using the AWS console.

Using CLI

To remediate the misconfiguration of using AWS-managed keys for AWS RDS instances and switch to using Customer-Managed Keys, you can follow these steps using the AWS CLI:

Create a Customer Managed Key (CMK):
- Use the AWS Key Management Service (KMS) to create a new Customer Managed Key (CMK) if you don't already have one.
- Run the following command to create a CMK:
```
aws kms create-key --description "Customer Managed Key for RDS Encryption"
```
- Note down the KeyId value from the output, as you will need it in the next steps.
Enable encryption with the Customer Managed Key for the RDS instance:
- Modify the RDS instance to use the newly created CMK for encryption.
- Run the following command to modify the RDS instance to use the Customer Managed Key:
```
aws rds modify-db-instance --db-instance-identifier YOUR_DB_INSTANCE_IDENTIFIER --kms-key-id YOUR_CMK_KEY_ID
```
- Replace YOUR_DB_INSTANCE_IDENTIFIER with the identifier of your RDS instance and YOUR_CMK_KEY_ID with the KeyId of the Customer Managed Key created in step 1.
Verify the encryption settings:
- Confirm that the RDS instance is now using the Customer Managed Key for encryption.
- Run the following command to describe the RDS instance and verify the encryption settings:
```
aws rds describe-db-instances --db-instance-identifier YOUR_DB_INSTANCE_IDENTIFIER --query "DBInstances[*].KmsKeyId"
```
- Ensure that the KmsKeyId returned in the output matches the KeyId of the Customer Managed Key.
Monitor the RDS instance:
- Monitor the RDS instance to ensure that there are no issues after switching to Customer Managed Key encryption.
- Check the RDS instance logs and performance metrics to ensure everything is functioning as expected.

By following these steps, you can remediate the misconfiguration of using AWS-managed keys for AWS RDS instances and switch to using Customer-Managed Keys successfully using the AWS CLI.

Using Python

To remediate this misconfiguration for AWS RDS using Python, you can follow these steps:

Create a Customer-Managed Key (CMK) in AWS Key Management Service (KMS):

Use the boto3 library in Python to create a new CMK in AWS KMS. Here is an example code snippet to create a CMK:

import boto3

kms_client = boto3.client('kms')

response = kms_client.create_key(
    Description='My Customer-Managed Key',
    KeyUsage='ENCRYPT_DECRYPT',
    Origin='AWS_KMS',
)

cmk_id = response['KeyMetadata']['KeyId']

Update the RDS instance to use the Customer-Managed Key:
- Use the boto3 library to modify the RDS instance to use the newly created CMK. Here is an example code snippet to update the RDS instance to use the CMK:
```
rds_client = boto3.client('rds')

response = rds_client.modify_db_instance(
    DBInstanceIdentifier='your-rds-instance-id',
    KmsKeyId=cmk_id,
)
```
Verify the changes:
- You can verify that the RDS instance is now using the Customer-Managed Key by describing the RDS instance and checking the KmsKeyId attribute. Here is an example code snippet to describe the RDS instance:
```
response = rds_client.describe_db_instances(
    DBInstanceIdentifier='your-rds-instance-id',
)

kms_key_id = response['DBInstances'][0]['KmsKeyId']
print(f"KMS Key ID used by RDS instance: {kms_key_id}")
```

By following these steps and running the Python code, you can remediate the misconfiguration by using a Customer-Managed Key instead of AWS-managed Keys for your AWS RDS instance.

Using Terraform

resource "aws_kms_key" "rds_cmk" {
  description             = "RDS CMK for {{ASSET_LABEL}}"
  deletion_window_in_days = 30

  # Optionally scope key usage with key_policy, tags, etc.
}

resource "aws_db_instance" "this" {
  # EXISTING CONFIG (examples – keep your current values)
  identifier              = "{{ASSET_LABEL}}"          # replace with your DB identifier
  engine                  = "postgres"                 # replace with your engine
  instance_class          = "db.t3.medium"             # replace with your instance class
  allocated_storage       = 100                        # replace with your size
  username                = "DB_MASTER_USERNAME"       # replace
  password                = "DB_MASTER_PASSWORD"       # replace or use aws_secretsmanager_secret
  db_subnet_group_name    = aws_db_subnet_group.this.name
  vpc_security_group_ids  = [aws_security_group.db.id]
  # …all other existing configuration (option group, parameter group, backups, etc.)

  # FIX: enable encryption with a customer-managed KMS key (CMK)
  storage_encrypted = true
  kms_key_id        = aws_kms_key.rds_cmk.arn

  # Ensure Terraform is allowed to replace the instance when changing KMS key
  skip_final_snapshot = false
  final_snapshot_identifier = "${var.name}-final-${formatdate("YYYYMMDDhhmmss", timestamp())}"
}

This change forces replacement of the RDS instance because AWS does not allow changing the KMS key of an existing instance in place; the replacement is equivalent to the CLI workflow of snapshot → copy-encrypted-with-CMK → restore-new-instance, and will cause downtime during cutover. Plan and execute in a maintenance window.

For verification, terraform plan should show the existing aws_db_instance.this being destroyed and recreated with storage_encrypted = true and kms_key_id = aws_kms_key.rds_cmk.arn, plus creation of aws_kms_key.rds_cmk.

Additional Reading:

https://aws.amazon.com/blogs/database/securing-data-in-amazon-rds-using-aws-kms-encryption/

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

Additional Reading:​