Performance Insights Encryption Customer Key

Performance Insights encryption should use Customer Managed Keys

Amazon RDS uses the AWS managed key for your new DB instance. For complete control over KMS keys, including establishing and maintaining their key policies, IAM policies, and grants, enabling and disabling them, and rotating their cryptographic material, use a customer managed keys. The encryption key specified in performance_insights_kms_key_id references a KMS ARN

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

1
2
3
4
5
6

Resources:
  GoodExample:
    Type: AWS::RDS::DBInstance
    Properties:
      EnablePerformanceInsights: true
      PerformanceInsightsKMSKeyId: something

1
2
3
4
5

resource "aws_rds_cluster_instance" "good_example" {
  name                            = "bar"
  performance_insights_enabled    = true
  performance_insights_kms_key_id = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
}

Links

• https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PerfInsights.access-control.html#USER_PerfInsights.access-control.cmk-policy

• https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-mgmt