AWS Key Management Service (KMS) key is disabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_227
Category - Subcategory	IAM - Expired Key Controls
Provider	AWS
Severity	LOW
Framework	Terraform
Mapped CSPM/KSPM Rule	c4a7a1ad-0e32-4dea-9ed7-284bdba72429

Impact

Ensuring that your Amazon Key Management Service (AWS KMS) key is enabled is important because it determines whether the key can be used to perform cryptographic operations. When a key is enabled, it can be used to encrypt, decrypt, and generate data keys. When it is disabled, it cannot be used for these operations.

How to Fix

[source,go]

resource "aws_kms_key" "pass" { description = "description" is_enabled = true policy = <<POLICY { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::111122223333:root" }, "Action": "kms:", "Resource": "" }, { "Effect": "Allow", "Principal": { "AWS": "" }, "Action": "kms:", "Resource": "*" }, ] } POLICY tags = { test = "Fail" } }