> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Rds encrypted with kms cmks remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of using AWS-managed keys instead of Customer-Managed Keys for AWS RDS using the AWS console, follow these steps:

        1. **Create a Customer-Managed Key (CMK)**:
           * Go to the AWS Key Management Service (KMS) console.
           * Click on "Create key" to create a new CMK.
           * Choose the key creation method (Symmetric key or Asymmetric key) based on your requirements.
           * Define key administrative permissions and key usage permissions.
           * Click on "Finish" to create the CMK.

        2. **Update the RDS Instance to use the Customer-Managed Key**:
           * Go to the Amazon RDS console.
           * Select the RDS instance for which you want to update the encryption key.
           * Click on "Modify" to modify the instance settings.
           * In the "Encryption" section, choose the option to encrypt using a Customer-Managed Key.
           * Select the Customer-Managed Key (CMK) that you created in step 1.
           * Click on "Continue" and review the changes.
           * Click on "Modify DB Instance" to apply the changes.

        3. **Monitor the Encryption Key Update**:
           * Once you have modified the RDS instance to use the Customer-Managed Key, monitor the instance to ensure that the encryption key update is successful.
           * Check the RDS instance status and logs for any errors related to the encryption key update.
           * Verify that the RDS instance is using the Customer-Managed Key for encryption.

        By following these steps, you can remediate the misconfiguration of using AWS-managed keys instead of Customer-Managed Keys for AWS RDS using the AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of using AWS-managed keys for AWS RDS instances and switch to using Customer-Managed Keys, you can follow these steps using the AWS CLI:

        1. **Create a Customer Managed Key (CMK)**:
           * Use the AWS Key Management Service (KMS) to create a new Customer Managed Key (CMK) if you don't already have one.
           * Run the following command to create a CMK:
             ```
             aws kms create-key --description "Customer Managed Key for RDS Encryption"
             ```
           * Note down the `KeyId` value from the output, as you will need it in the next steps.

        2. **Enable encryption with the Customer Managed Key for the RDS instance**:
           * Modify the RDS instance to use the newly created CMK for encryption.
           * Run the following command to modify the RDS instance to use the Customer Managed Key:
             ```
             aws rds modify-db-instance --db-instance-identifier YOUR_DB_INSTANCE_IDENTIFIER --kms-key-id YOUR_CMK_KEY_ID
             ```
           * Replace `YOUR_DB_INSTANCE_IDENTIFIER` with the identifier of your RDS instance and `YOUR_CMK_KEY_ID` with the `KeyId` of the Customer Managed Key created in step 1.

        3. **Verify the encryption settings**:
           * Confirm that the RDS instance is now using the Customer Managed Key for encryption.
           * Run the following command to describe the RDS instance and verify the encryption settings:
             ```
             aws rds describe-db-instances --db-instance-identifier YOUR_DB_INSTANCE_IDENTIFIER --query "DBInstances[*].KmsKeyId"
             ```
           * Ensure that the `KmsKeyId` returned in the output matches the `KeyId` of the Customer Managed Key.

        4. **Monitor the RDS instance**:
           * Monitor the RDS instance to ensure that there are no issues after switching to Customer Managed Key encryption.
           * Check the RDS instance logs and performance metrics to ensure everything is functioning as expected.

        By following these steps, you can remediate the misconfiguration of using AWS-managed keys for AWS RDS instances and switch to using Customer-Managed Keys successfully using the AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate this misconfiguration for AWS RDS using Python, you can follow these steps:

        1. **Create a Customer-Managed Key (CMK) in AWS Key Management Service (KMS)**:

           * Use the `boto3` library in Python to create a new CMK in AWS KMS. Here is an example code snippet to create a CMK:

           ```python theme={null}
           import boto3

           kms_client = boto3.client('kms')

           response = kms_client.create_key(
               Description='My Customer-Managed Key',
               KeyUsage='ENCRYPT_DECRYPT',
               Origin='AWS_KMS',
           )

           cmk_id = response['KeyMetadata']['KeyId']
           ```

        2. **Update the RDS instance to use the Customer-Managed Key**:

           * Use the `boto3` library to modify the RDS instance to use the newly created CMK. Here is an example code snippet to update the RDS instance to use the CMK:

           ```python theme={null}
           rds_client = boto3.client('rds')

           response = rds_client.modify_db_instance(
               DBInstanceIdentifier='your-rds-instance-id',
               KmsKeyId=cmk_id,
           )
           ```

        3. **Verify the changes**:

           * You can verify that the RDS instance is now using the Customer-Managed Key by describing the RDS instance and checking the `KmsKeyId` attribute. Here is an example code snippet to describe the RDS instance:

           ```python theme={null}
           response = rds_client.describe_db_instances(
               DBInstanceIdentifier='your-rds-instance-id',
           )

           kms_key_id = response['DBInstances'][0]['KmsKeyId']
           print(f"KMS Key ID used by RDS instance: {kms_key_id}")
           ```

        By following these steps and running the Python code, you can remediate the misconfiguration by using a Customer-Managed Key instead of AWS-managed Keys for your AWS RDS instance.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_kms_key" "rds_cmk" {
          description             = "RDS CMK for {{ASSET_LABEL}}"
          deletion_window_in_days = 30

          # Optionally scope key usage with key_policy, tags, etc.
        }

        resource "aws_db_instance" "this" {
          # EXISTING CONFIG (examples – keep your current values)
          identifier              = "{{ASSET_LABEL}}"          # replace with your DB identifier
          engine                  = "postgres"                 # replace with your engine
          instance_class          = "db.t3.medium"             # replace with your instance class
          allocated_storage       = 100                        # replace with your size
          username                = "DB_MASTER_USERNAME"       # replace
          password                = "DB_MASTER_PASSWORD"       # replace or use aws_secretsmanager_secret
          db_subnet_group_name    = aws_db_subnet_group.this.name
          vpc_security_group_ids  = [aws_security_group.db.id]
          # …all other existing configuration (option group, parameter group, backups, etc.)

          # FIX: enable encryption with a customer-managed KMS key (CMK)
          storage_encrypted = true
          kms_key_id        = aws_kms_key.rds_cmk.arn

          # Ensure Terraform is allowed to replace the instance when changing KMS key
          skip_final_snapshot = false
          final_snapshot_identifier = "${var.name}-final-${formatdate("YYYYMMDDhhmmss", timestamp())}"
        }
        ```

        This change forces **replacement** of the RDS instance because AWS does not allow changing the KMS key of an existing instance in place; the replacement is equivalent to the CLI workflow of snapshot → copy-encrypted-with-CMK → restore-new-instance, and will cause downtime during cutover. Plan and execute in a maintenance window.

        For verification, `terraform plan` should show the existing `aws_db_instance.this` being **destroyed and recreated** with `storage_encrypted = true` and `kms_key_id = aws_kms_key.rds_cmk.arn`, plus creation of `aws_kms_key.rds_cmk`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>