Alibaba Cloud OSS bucket is not encrypted with Customer Master Key misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_ALI_6
Category - Subcategory	Storage - Encryption
Provider	ALIBABA_CLOUD
Severity	MEDIUM
Framework	Terraform

Impact

This rule ensures that Alibaba Cloud OSS (Object Storage Service) buckets are encrypted using a Customer Master Key (CMK). Encrypting buckets with a CMK enhances data security by providing granular control over key management, including key rotation, access policies, and auditing.

Failing to use a CMK for encryption can increase the risk of unauthorized access to sensitive data and make it harder to meet compliance and security requirements.

How to Fix

Resource: alicloud_oss_bucket

• Arguments: server_side_encryption_rule.kms_master_key_id

To mitigate this issue, ensure the server_side_encryption_rule.kms_master_key_id attribute is configured with a valid CMK ID in the alicloud_oss_bucket resource.

Example: [source,go]

resource "alicloud_oss_bucket" "example" { ... server_side_encryption_rule {

• kms_master_key_id = "1234abcd-12ab-34cd-56ef-1234567890ab" # Replace with your CMK ID } }

---