SSM parameters are not utilizing KMS CMK. misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_337
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	HIGH
Framework	Terraform, Terraform Plan

Impact

This rule is verifying that AWS System Manager parameters are utilizing Key Management Service (KMS) customer-managed keys (CMK) for encryption. This rule is crucial for providing additional layers of security, as it ensures that all sensitive data processed and stored by System Manager parameters are protected by reliable encryption methods. Not complying with this rule means your SSM parameters are not fully protected, leading to potential data breaches and non-compliance with data protection regulations.

How to Fix

Resource: aws_ssm_parameter

• Arguments: key_id

To fix the issue, you should enable encryption for SSM (System Manager) parameters using KMS Customer Master Key (CMK). CMK allows you to have more flexibility around key management, including who can use the key and for what resources.

In the above code, the aws_ssm_parameter resource is configured to use a key from KMS (Key Management Service). The key_id attribute specifies the ARN (Amazon Resource Name) of the KMS key that should be used for encrypting the value of the parameter. [source,go]

resource "aws_ssm_parameter" "example" { name = "example" type = "SecureString" value = "example_value" key_id = "arn:aws:kms:us-east-1:123456789012:key/abcd1234-a123-456a-a12b-a123b4cd56ef" }