LOW
Source
Trivy
ID
AVD-AWS-0098

Secrets Manager should use customer managed keys

Secrets Manager encrypts secrets by default using a default key created by AWS. To ensure control and granularity of secret encryption, CMK’s should be used explicitly.

Impact

Using AWS managed keys reduces the flexibility and control over the encryption key

Follow the appropriate remediation steps below to resolve the issue.

Use customer managed keys

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
---
AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template
AWSTemplateFormatVersion: 2010-09-09
Description: Good example of ingress rule
Resources:
  Secret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Description: "secret"
      KmsKeyId: "my-key-id"
      Name: "blah"
      SecretString: "don't tell anyone"

Use customer managed keys

1
2
3
4
5
6
7
8
resource "aws_kms_key" "secrets" {
  enable_key_rotation = true
}

resource "aws_secretsmanager_secret" "good_example" {
  name       = "lambda_password"
  kms_key_id = aws_kms_key.secrets.arn
}