Session Manager data is not encrypted in transit misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_112
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule identifies AWS RDS DB (Relational Database Service Database) cluster snapshots which are not encrypted. It is highly recommended to implement encryption at rest when you are working with production data that have sensitive information, to protect from unauthorized access.

How to Fix

Resource: aws_ssm_document

• Arguments: kmsKeyId [source,go]

---

resource "aws_ssm_document" "enabled" { name = "SSM-SessionManagerRunShell" document_type = "Session"

content = <<DOC { ... "inputs": { ... "s3EncryptionEnabled": true,

• "kmsKeyId": "${var.kms_key_id}", "runAsEnabled": false, ... } } } DOC }

---