> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # KMS Key Should Have Unique Key In An App-Tier ### More Info: Ensure that there is a KMS Key in the App-tier in order to protect the data that is transmitted from the application stack. ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration "KMS Key Should Have Unique Key In An App-Tier" for GCP using GCP console, follow the below steps: 1. Login to your GCP console. 2. Go to the Cloud KMS page. 3. Click on the Key Rings in the left-hand menu. 4. Select the key ring in which the misconfigured key is present. 5. Select the key that has the misconfiguration. 6. Click on the "Edit" button at the top of the page. 7. In the "Key rotation" section, enable the "Automatic key rotation" option. 8. In the "Labels" section, add a label with a unique key that identifies the key as being used in the app-tier. 9. Click on the "Save" button to save the changes. By following the above steps, you have now remediated the misconfiguration "KMS Key Should Have Unique Key In An App-Tier" for GCP using GCP console. # To remediate this misconfiguration in GCP using GCP CLI, you can follow the below steps: 1. Open the Cloud Shell in the GCP console. 2. Set the project where the KMS key exists as the default project using the following command: ``` gcloud config set project [PROJECT_ID] ``` 3. Get the list of all the KMS keys in the project using the following command: ``` gcloud kms keys list ``` 4. Identify the KMS key that is used in the app-tier and note down its name. 5. Get the details of the KMS key using the following command: ``` gcloud kms keys describe [KEY_NAME] ``` 6. Check if the key is unique by verifying that it is not used in any other app-tier in the project. 7. If the key is not unique, create a new KMS key using the following command: ``` gcloud kms keys create [NEW_KEY_NAME] --location [LOCATION] --keyring [KEYRING_NAME] --purpose encryption ``` Replace \[NEW\_KEY\_NAME] with a unique name for the new KMS key, \[LOCATION] with the location where you want to create the key, and \[KEYRING\_NAME] with the name of the keyring where you want to create the key. 8. Update the app-tier to use the new KMS key. 9. Delete the old KMS key using the following command: ``` gcloud kms keys delete [KEY_NAME] ``` Replace \[KEY\_NAME] with the name of the old KMS key that you want to delete. 10. Verify that the misconfiguration has been remediated by checking that the KMS key used in the app-tier is unique and not used in any other app-tier in the project. To remediate the misconfiguration "KMS Key Should Have Unique Key In An App-Tier" for GCP using Python, you can follow these steps: 1. Identify the KMS key that is being used by the App-Tier in GCP. 2. Check if the KMS key is unique and not being used by any other application or service in GCP. 3. If the KMS key is not unique, create a new KMS key for the App-Tier. 4. Update the App-Tier to use the new KMS key. Here's the Python code to remediate the misconfiguration: ```python theme={null} from google.cloud import kms_v1 # Set the name of the KMS key being used by the App-Tier key_name = 'projects//locations//keyRings//cryptoKeys/' # Create a KMS client client = kms_v1.KeyManagementServiceClient() # Check if the KMS key is unique response = client.list_key_rings(parent='projects//locations/') for key_ring in response: for crypto_key in key_ring.crypto_keys: if crypto_key.name == key_name: print('KMS key is not unique.') # Create a new KMS key for the App-Tier new_key_name = 'projects//locations//keyRings//cryptoKeys/new_key' new_key = client.create_crypto_key(parent='projects//locations//keyRings/', crypto_key_id='new_key', purpose=kms_v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT) # Update the App-Tier to use the new KMS key # ... break else: continue break else: print('KMS key is unique.') ``` Note: Replace ``, ``, ``, `` with the appropriate values for your GCP project and KMS key. ```hcl theme={null} # KMS key ring (if not already managed in Terraform) resource "google_kms_key_ring" "app_tier" { name = "APP_TIER_KEY_RING_NAME" # replace with the desired key ring name location = "KMS_LOCATION" # e.g., "us-central1" project = "GCP_PROJECT_ID" # your GCP project ID } # App-tier KMS CryptoKey with a unique label identifying the application tier resource "google_kms_crypto_key" "app_tier" { name = "APP_TIER_CRYPTO_KEY_NAME" # replace with a unique key name key_ring = google_kms_key_ring.app_tier.id purpose = "ENCRYPT_DECRYPT" # Ensure the app-tier label is present and unique for this tier labels = { TIER_LABEL_KEY = "TIER_LABEL_VALUE" # replace TIER_LABEL_KEY/TIER_LABEL_VALUE with the label key/value used to mark app-tier } rotation_period = "2592000s" # optional: 30 days; adjust as needed } ``` This adds a dedicated KMS CryptoKey for the application tier, identified by the specified label key/value. No existing resources are forced to be replaced unless you attach this new key to other resources. After updating Terraform, `terraform plan` should show one new `google_kms_key_ring` (if it didn’t exist) and one new `google_kms_crypto_key` to be created, with the app-tier label set.