A Policy is not Defined for KMS Key misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_64
Category - Subcategory	IAM - Expired Key Controls
Provider	AWS
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule is designed to detect situations where the KMS key policy is undefined within your AWS environment. KMS keys are essential for data encryption and it's crucial to monitor and manage the policies that define their use to ensure data security is maintained.

How to Fix

Resource: aws_kms_key

• Arguments: policy

The policy argument should be specified to define the KMS key policy.

Secure code example:

The above code is secure because it defines a valid key policy for the KMS key, ensuring that access and usage are managed according to the organization's requirements. [source,go]

resource "aws_kms_key" "example" { description = "KMS key for example" policy = <<POLICY { "Version": "2012-10-17", "Id": "default", "Statement": [ { "Sid": "DefaultAllow", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:root" }, "Action": "kms:", "Resource": "" } ] } POLICY }