CloudTrail Event Data Store does not use Customer Managed Keys (CMKs) misconfiguration detected in c

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_294
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan

Impact

This rule checks to ensure that Cloud Trail Event Data Store uses a Customer Master Key (CMK) for encryption. It's crucial for data security because without the CMK, the default key generated by AWS would be used. If this default key is compromised, the security of all data could be endangered. Hence, to provide an extra layer of control and security, it's advisable to use a Customer Master Key for encryption.

How to Fix

Resource: aws_cloudtrail_event_data_store

• Arguments: kms_key_id

To fix the issue, a custom CMK needs to be specified for the Cloud Trail Event Data Store. This can be achieved by using the AWS Key Management Service (KMS) to create a new CMK and then specifying its ARN in the kms_key_id property in your Cloud Trail configuration in your Terraform file. [source,go]

resource "aws_cloudtrail_event_data_store" "pass" { name = "pike-data-store"

• kms_key_id = aws_kms_key.example.arn }

---