AWS AMI copying does not use a Customer Managed Key (CMK) misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_236
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	Terraform

Impact

This rule identifies AMI copies which are encrypted with default KMS keys and not with Keys managed by Customer. It is a best practice to use customer-managed KMS Keys to encrypt your AMI copies data. It gives you full control over the encrypted data.

How to Fix

[source,go]

resource "aws_ami_copy" "pass" { name = "terraform-example" description = "A copy of ami-xxxxxxxx" source_ami_id = "ami-xxxxxxxx" source_ami_region = "us-west-1" encrypted = true #default is false kms_key_id = aws_kms_key.copy.arn tags = { Name = "HelloWorld" test = "failed" } }