The Connect Instance S3 Storage Configuration utilizes Customer Managed Key. misconfiguration detect

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_270
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	HIGH
Framework	Terraform, Terraform Plan

Impact

This rule checks whether an Amazon Connect instance uses a Customer Master Key (CMK) for its S3 storage configuration. It underscores the importance of encrypting data at rest to prevent unauthorized access to sensitive information. The use of a CMK allows more granular control over the cryptographic keys, including the ability to create, rotate, disable, and define access permissions and usage. Thus, it significantly enhances the data security posture. If the rule check fails, it indicates that the Amazon Connect instance's S3 storage is either not encrypted or using default encryption, which presents a potential security risk.

How to Fix

Resource: aws_connect_instance_storage_config

• Arguments: storage_config.s3_config.encryption_config.key_id

You should configure the 'key_id' service to use AWS Key Management Service (AWS KMS), this will allow control over who can use the master key and decrypt messages. [source,go]

resource "aws_connect_instance_storage_config" "pass" { instance_id = aws_connect_instance.pass.id resource_type = "CHAT_TRANSCRIPTS"

storage_config { s3_config { bucket_name = aws_s3_bucket.pass.id bucket_prefix = "pass"

encryption_config { encryption_type = "KMS"

• key_id = aws_kms_key.example.arn } } storage_type = "S3" } }

---