Document AI Warehouse Location is not configured to use a Customer Managed Key (CMK) misconfiguratio

Rule Details

Cortex AppSec Rule ID	APPSEC2_GCP_23
Category - Subcategory	Storage - Encryption
Provider	GCP
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule is checking to make sure that Document AI Warehouse Location is configured to use a Customer Managed Key (CMK). This step is important because it ensures that data stored in Document AI Warehouse in Google Cloud Platform is protected by encryption. Using a Customer Managed Key gives the user more control over their encryption settings, as they can set key rotation periods and disable the key when necessary. This reduces the risk of unauthorized access to data. Without a CMK, data might become vulnerable to security threats.

How to Fix

Resource: google_document_ai_warehouse_location

• Arguments: kms_key

In order to fix this issue, you need to specify the customer-managed encryption key while creating a document warehouse. This can be done by using the kms_key attribute in your google_document_ai_warehouse_location resource.

The updated code now properly employs a Customer Managed Key (CMK) for handling the encryption of the document AI warehouse. This enhances the overall security as it provides tighter control over the cryptographic keys by the cloud customer compared to default encryption that uses Google-managed keys. Key Access Justifications helps to ensure that only the expected keys are being accessed. This also provides audit logging for all key usage, aiding in regulatory and compliance efforts. [source,go]

resource "google_document_ai_warehouse_location" "example" { ... kms_key = "some_value" ... }