> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Check For The Existence of Specific KMS CMKs

### More Info:

Ensure that a specific list of KMS CMKs are available for use in your AWS account in order to meet the security and compliance requirements of the organization.

### Risk Level

Low

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of checking for the existence of specific KMS CMKs in GCP using GCP console, follow these steps:

        1. Open the Google Cloud Console and select the project that you want to work on.

        2. In the navigation menu, select "Security" and then select "Security Health Analytics".

        3. Under "Security Health Analytics", select "Findings".

        4. In the search bar, enter "KMS" and select "KMS Key Ring Has No Rotation Policy".

        5. This will show you a list of all the KMS key rings that have no rotation policy.

        6. For each key ring that has no rotation policy, click on the key ring name to open it.

        7. In the key ring page, click on the "Edit" button.

        8. Under "Rotation Interval", select the desired rotation interval from the drop-down menu.

        9. Click on "Save" to save the changes.

        10. Repeat steps 6-9 for all the key rings that have no rotation policy.

        By following these steps, you will remediate the misconfiguration of checking for the existence of specific KMS CMKs in GCP using GCP console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of checking for the existence of specific KMS CMKs in GCP using GCP CLI, you can follow the below steps:

        1. Open the Google Cloud Shell or any terminal window where you have installed the GCP CLI and authenticate with your GCP account using the following command:

           ```
           gcloud auth login
           ```

        2. Check the list of all the available key rings in the project using the following command:

           ```
           gcloud kms keyrings list --location=global
           ```

        3. Identify the specific key ring that contains the CMKs that you want to check for existence.

        4. Check the list of all the available Crypto Keys in the identified key ring using the following command:

           ```
           gcloud kms keys list --location=global --keyring=<keyring-name>
           ```

           Replace `<keyring-name>` with the name of the identified key ring.

        5. Identify the specific CMK that you want to check for existence.

        6. Check the existence of the identified CMK using the following command:

           ```
           gcloud kms keys describe <key-name> --location=global --keyring=<keyring-name>
           ```

           Replace `<key-name>` with the name of the identified CMK and `<keyring-name>` with the name of the identified key ring.

        7. If the command returns an error message stating that the key does not exist, then the CMK does not exist. In this case, you can create the CMK using the following command:

           ```
           gcloud kms keys create <key-name> --location=global --keyring=<keyring-name> --purpose=<purpose>
           ```

           Replace `<key-name>` with the name of the CMK that you want to create, `<keyring-name>` with the name of the identified key ring, and `<purpose>` with the purpose of the CMK (e.g. `encryption`).

           Note: You need to have the necessary IAM permissions to create a new CMK.

        8. If the command returns the details of the CMK, then the CMK exists and no further action is required.

        By following these steps, you can remediate the misconfiguration of checking for the existence of specific KMS CMKs in GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of checking for the existence of specific KMS CMKs in GCP using python, you can follow the below steps:

        1. Import the necessary modules:

        ```
        from google.cloud import kms_v1
        from google.oauth2 import service_account
        ```

        2. Set up the credentials for authentication:

        ```
        credentials = service_account.Credentials.from_service_account_file('<path_to_service_account_file>')
        ```

        3. Create a client object for the Key Management Service:

        ```
        client = kms_v1.KeyManagementServiceClient(credentials=credentials)
        ```

        4. Define the name of the keyring and the key to check for existence:

        ```
        keyring_name = 'my-keyring'
        key_name = 'my-key'
        ```

        5. Use the client object to check for the existence of the key:

        ```
        parent = client.key_ring_path('<project_id>', '<location>', keyring_name)
        key_full_name = client.crypto_key_path_path('<project_id>', '<location>', keyring_name, key_name)

        try:
            client.get_crypto_key(key_full_name)
            print(f'Key {key_full_name} exists.')
        except:
            print(f'Key {key_full_name} does not exist.')
        ```

        6. Replace `<path_to_service_account_file>`, `<project_id>`, `<location>`, `<keyring_name>`, and `<key_name>` with the appropriate values for your GCP environment.

        7. Run the script to check for the existence of the specified KMS CMKs, and remediate any that do not exist.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Key ring where your CMKs (CryptoKeys) will live
        resource "google_kms_key_ring" "ORG_KEY_RING" {
          project  = "GCP_PROJECT_ID"   # replace with your GCP project ID
          name     = "ORG_KEY_RING_NAME" # replace with your key ring name
          location = "KMS_LOCATION"      # e.g. "us-central1", "europe-west1"
        }

        # Example: ensure specific CMKs exist (one resource per required CMK)
        resource "google_kms_crypto_key" "CMK_APP1" {
          name            = "cmk-app1"   # replace with required CMK name
          key_ring        = google_kms_key_ring.ORG_KEY_RING.id
          purpose         = "ENCRYPT_DECRYPT"

          rotation_period = "2592000s"   # optional: 30 days; adjust to your policy
        }

        resource "google_kms_crypto_key" "CMK_APP2" {
          name            = "cmk-app2"   # replace with required CMK name
          key_ring        = google_kms_key_ring.ORG_KEY_RING.id
          purpose         = "ENCRYPT_DECRYPT"

          rotation_period = "7776000s"   # optional: 90 days; adjust to your policy
        }

        # Add one google_kms_crypto_key resource per CMK listed in your specific_cmks threshold.
        ```

        Creating new `google_kms_crypto_key` resources does not replace existing keys; changing a key’s `name` or `key_ring` later will force replacement and a new key version (plan will show `forces replacement`).

        For verification, `terraform plan` should show `+ create` for each `google_kms_crypto_key` corresponding to a required CMK that does not yet exist, and no changes for keys that are already present and correctly configured.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>