AWS CodeGuru Reviewer repository association does not use a Customer Managed Key (CMK) misconfigurat

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_381
Category - Subcategory	Storage - Encryption
Provider	AWS
Severity	LOW
Framework	Terraform, Terraform Plan

Impact

This rule detects whether AWS CodeGuru Reviewer repository associations use Customer Managed Key (CMK) for encryption. CMKs empower users with granular control over key management, including policy setting, usage permissions, and detailed monitoring of access and key rotations. Default encryption options may not provide the level of security and compliance required for sensitive environments. Enforcing the use of CMKs for AWS CodeGuru Reviewer repository associations enables organizations to maintain strict access control and auditing, strengthening overall security posture.

How to Fix

Terraform

• Resource: aws_codegurureviewer_repository_association

• Arguments: kms_key_details

To mitigate this issue, ensure that the encryption_option parameter in the kms_key_details block is set to CUSTOMER_MANAGED_CMK. This ensures that a CMK is used for encryption.

Example: [source,go]

resource "aws_codegurureviewer_repository_association" "example" { ... kms_key_details {

• encryption_option = "CUSTOMER_MANAGED_CMK" } }

---