AWS AMIs are not encrypted by Key Management Service (KMS) using Customer Managed Keys (CMKs) miscon

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_204
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	Terraform

Impact

This rule identifies AMIs which are encrypted with default KMS keys and not with Keys managed by Customer. It is a best practice to use customer managed KMS Keys to encrypt your EFS data. It gives you full control over the encrypted data.

How to Fix

[source,go]

resource "aws_ami" "pass" { name = "terraform-example" virtualization_type = "hvm" root_device_name = "/dev/xvda1"

ebs_block_device { device_name = "/dev/xvda1" volume_size = 8 snapshot_id = "someid" }

ebs_block_device { device_name = "/dev/xvda2" volume_size = 8 encrypted = true } }