Secret Use Customer Key | Vulnerability Database

Secrets Manager should use customer managed keys

Secrets Manager encrypts secrets by default using a default key created by AWS. To ensure control and granularity of secret encryption, CMK’s should be used explicitly.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Use customer managed keys

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


AWSTemplateFormatVersion: "2010-09-09"

Description: Good example of ingress rule

Resources:
  Secret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Description: secret
      KmsKeyId: my-key-id
      Name: blah
      SecretString: don't tell anyone

Use customer managed keys

1
2
3
4
5
6
7
8


resource "aws_kms_key" "secrets" {
  enable_key_rotation = true
}

resource "aws_secretsmanager_secret" "good_example" {
  name       = "lambda_password"
  kms_key_id = aws_kms_key.secrets.arn
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret#kms_key_id